executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:48 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 5 printk messages dropped ** [  918.283226] binder: 10494:10497 ioctl c0306201 200002c0 returned -14
01:48:48 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:48 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:48 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:48 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  918.283383] binder: undelivered TRANSACTION_ERROR: 29189
** 8 printk messages dropped ** [  918.423453] binder: 10514:10515 ioctl c0306201 200002c0 returned -14
01:48:48 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:48 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:48 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  918.423592] binder: undelivered TRANSACTION_ERROR: 29189
[  918.454195] binder_alloc: 10518: binder_alloc_buf, no vma
[  918.454241] binder: 10518:10520 transaction failed 29189/-3, size 24-8 line 3137
01:48:48 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:48 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:48 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 6 printk messages dropped ** [  918.525821] binder: 10533:10535 ioctl c0306201 200002c0 returned -14
01:48:48 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:48 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  918.525973] binder: undelivered TRANSACTION_ERROR: 29189
01:48:48 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:48 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:48 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:48 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 2 printk messages dropped ** [  918.628069] binder: 10542:10549 Release 1 refcount change on invalid ref 1 ret -22
01:48:48 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:48 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:48 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 5 printk messages dropped ** [  918.693030] binder: 10553:10557 ioctl c0306201 200002c0 returned -14
01:48:48 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:48 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:48 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:48 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 11 printk messages dropped ** [  918.812733] binder: 10574:10575 ioctl c0306201 20000380 returned -22
01:48:48 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  918.812871] binder: undelivered TRANSACTION_ERROR: 29189
01:48:48 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:48 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:48 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:48 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 7 printk messages dropped ** [  918.922421] binder: 10589:10591 unknown command -1073488791
01:48:48 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:48 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:48 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:48 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  918.922429] binder: 10589:10591 ioctl c0306201 20000380 returned -22
01:48:48 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:48 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:48 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:48 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 5 printk messages dropped ** [  919.055181] binder_alloc: 10610: binder_alloc_buf, no vma
01:48:49 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 2 printk messages dropped ** [  919.055805] binder: 10610:10613 unknown command -1073488791
01:48:49 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:49 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 5 printk messages dropped ** [  919.084621] binder: undelivered TRANSACTION_ERROR: 29189
[  919.186263] binder_alloc: 10625: binder_alloc_buf, no vma
[  919.186308] binder: 10625:10627 transaction failed 29189/-3, size 24-8 line 3137
01:48:49 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:49 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:49 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:49 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 1 printk messages dropped ** [  919.187184] binder: 10625:10627 unknown command -1073488791
01:48:49 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:49 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:49 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 5 printk messages dropped ** [  919.211336] binder: undelivered TRANSACTION_ERROR: 29189
01:48:49 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:49 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  919.493806] binder_alloc: 10652: binder_alloc_buf, no vma
[  919.493852] binder: 10652:10654 transaction failed 29189/-3, size 24-8 line 3137
01:48:49 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:49 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:49 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:49 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 8 printk messages dropped ** [  919.766618] binder: 10671:10676 Release 1 refcount change on invalid ref 1 ret -22
01:48:49 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:49 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:49 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:49 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  919.766625] binder: 10671:10676 unknown command -1073488791
** 4 printk messages dropped ** [  919.790741] binder: 10679:10680 ioctl c0306201 200002c0 returned -14
01:48:49 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:49 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:49 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:49 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:49 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 7 printk messages dropped ** [  919.933555] binder: 10693:10695 Release 1 refcount change on invalid ref 1 ret -22
01:48:49 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:49 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:49 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:49 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:49 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 5 printk messages dropped ** [  920.052505] binder: 10713:10716 ioctl c0306201 200002c0 returned -14
01:48:49 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:49 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:49 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 9 printk messages dropped ** [  920.182788] binder: BINDER_SET_CONTEXT_MGR already set
01:48:49 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:49 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 3 printk messages dropped ** [  920.187259] binder: 10731:10737 ioctl c0306201 200002c0 returned -14
01:48:49 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:49 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:49 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:49 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:49 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  920.187417] binder: undelivered TRANSACTION_ERROR: 29189
** 2 printk messages dropped ** [  920.188465] binder: 10732:10736 ioctl c0306201 20000380 returned -22
01:48:49 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:49 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:49 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 5 printk messages dropped ** [  920.331334] binder_alloc: 10748: binder_alloc_buf, no vma
[  920.331380] binder: 10748:10754 transaction failed 29189/-3, size 24-8 line 3137
01:48:49 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:49 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  920.331542] binder: 10748:10754 Release 1 refcount change on invalid ref 1 ret -22
01:48:49 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:49 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:49 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:49 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  920.331548] binder: 10748:10754 unknown command -1073488791
[  920.331598] binder: 10748:10754 ioctl c0306201 20000380 returned -22
01:48:50 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:50 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:50 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 1 printk messages dropped ** [  920.432613] binder_alloc: 10770: binder_alloc_buf, no vma
01:48:50 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:50 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:50 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 3 printk messages dropped ** [  920.454843] binder_alloc: 10767: binder_alloc_buf, no vma
01:48:50 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:50 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:50 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:50 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  920.454889] binder: 10767:10774 transaction failed 29189/-3, size 24-8 line 3137
** 4 printk messages dropped ** [  920.532400] binder_alloc: 10785: binder_alloc_buf, no vma
01:48:50 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:50 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 3 printk messages dropped ** [  920.543131] binder: 10785:10789 Release 1 refcount change on invalid ref 1 ret -22
01:48:50 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:50 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:50 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  920.543139] binder: 10785:10789 unknown command -1073488791
01:48:50 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:50 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 4 printk messages dropped ** [  920.543845] binder: 10788:10792 ioctl c0306201 200002c0 returned -14
01:48:50 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:50 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:50 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 3 printk messages dropped ** [  920.639752] binder: 10802:10805 ioctl c0306201 200002c0 returned -14
01:48:50 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:50 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:50 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:50 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:50 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 9 printk messages dropped ** [  920.776152] binder: 10822:10825 ioctl c0306201 200002c0 returned -14
[  920.776303] binder: undelivered TRANSACTION_ERROR: 29189
01:48:50 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:50 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:50 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:50 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:50 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:50 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 8 printk messages dropped ** [  920.909567] binder: 10843:10846 Release 1 refcount change on invalid ref 1 ret -22
01:48:50 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:50 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:50 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:50 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:50 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 9 printk messages dropped ** [  921.023901] binder: 10856:10862 Release 1 refcount change on invalid ref 1 ret -22
01:48:50 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:50 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:50 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:50 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:50 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:50 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 9 printk messages dropped ** [  921.161707] binder: 10878:10882 Release 1 refcount change on invalid ref 1 ret -22
[  921.161714] binder: 10878:10882 unknown command -1073488791
[  921.161722] binder: 10878:10882 ioctl c0306201 20000380 returned -22
01:48:50 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:50 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:50 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:50 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  921.161879] binder: undelivered TRANSACTION_ERROR: 29189
[  921.168111] binder_alloc: 10877: binder_alloc_buf, no vma
** 5 printk messages dropped ** [  921.292479] binder: 10898:10901 Release 1 refcount change on invalid ref 1 ret -22
01:48:50 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:51 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:51 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  921.292486] binder: 10898:10901 unknown command -1073488791
01:48:51 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:51 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:51 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:51 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:51 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 8 printk messages dropped ** [  921.445302] binder: 10920:10922 ioctl c0306201 200002c0 returned -14
[  921.445459] binder: undelivered TRANSACTION_ERROR: 29189
01:48:51 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:51 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:51 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:51 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:51 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 4 printk messages dropped ** [  921.449129] binder: 10919:10925 ioctl c0306201 20000380 returned -22
01:48:51 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 3 printk messages dropped ** [  921.589563] binder: 10936:10942 Release 1 refcount change on invalid ref 1 ret -22
01:48:51 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:51 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:51 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:51 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:51 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:51 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 11 printk messages dropped ** [  921.688763] binder: 10954:10956 ioctl c0306201 20000380 returned -22
01:48:51 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:51 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:51 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 5 printk messages dropped ** [  921.753466] binder_alloc: 10968: binder_alloc_buf, no vma
[  921.753511] binder: 10968:10969 transaction failed 29189/-3, size 24-8 line 3137
01:48:51 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:51 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:51 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:51 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 8 printk messages dropped ** [  921.843604] binder_alloc: 10976: binder_alloc_buf, no vma
01:48:51 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:51 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:51 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  921.843649] binder: 10976:10979 transaction failed 29189/-3, size 24-8 line 3137
01:48:51 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:51 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:51 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:51 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 8 printk messages dropped ** [  922.015910] binder_alloc: 11002: binder_alloc_buf, no vma
[  922.015956] binder: 11002:11005 transaction failed 29189/-3, size 24-8 line 3137
[  922.016149] binder: 11002:11005 Release 1 refcount change on invalid ref 1 ret -22
01:48:51 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:51 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:51 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:51 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 3 printk messages dropped ** [  922.069893] binder_alloc: 11008: binder_alloc_buf, no vma
01:48:51 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:51 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 3 printk messages dropped ** [  922.155390] binder_alloc: 11023: binder_alloc_buf, no vma
01:48:51 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:51 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:51 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  922.155436] binder: 11023:11026 transaction failed 29189/-3, size 24-8 line 3137
01:48:51 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:51 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 2 printk messages dropped ** [  922.158645] binder_alloc: 11023: binder_alloc_buf, no vma
** 5 printk messages dropped ** [  922.164241] binder: 11023:11026 ioctl c0306201 200002c0 returned -14
01:48:51 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:51 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  922.164374] binder: undelivered TRANSACTION_ERROR: 29189
01:48:51 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:51 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:52 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 2 printk messages dropped ** [  922.273045] binder: 11040:11041 ioctl c0306201 200002c0 returned -14
01:48:52 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:52 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:52 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:52 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 1 printk messages dropped ** [  922.283166] binder_alloc: 11035: binder_alloc_buf, no vma
01:48:52 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:52 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:52 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:52 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  922.283211] binder: 11035:11042 transaction failed 29189/-3, size 24-8 line 3137
** 2 printk messages dropped ** [  922.283367] binder: 11035:11042 ioctl c0306201 20000380 returned -22
01:48:52 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:52 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:52 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 5 printk messages dropped ** [  922.430761] binder_alloc: 11060: binder_alloc_buf, no vma
01:48:52 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:52 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:52 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:52 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 3 printk messages dropped ** [  922.431038] binder: 11060:11063 ioctl c0306201 20000380 returned -22
01:48:52 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:52 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:52 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 5 printk messages dropped ** [  922.557807] binder: 11075:11080 ioctl c0306201 20000380 returned -22
[  922.562571] binder: undelivered TRANSACTION_ERROR: 29189
[  922.678211] binder_alloc: 11095: binder_alloc_buf, no vma
01:48:52 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  922.678257] binder: 11095:11098 transaction failed 29189/-3, size 24-8 line 3137
01:48:52 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:52 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:52 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:52 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 6 printk messages dropped ** [  922.693844] binder: 11096:11101 ioctl c0306201 20000380 returned -22
[  922.693993] binder: undelivered TRANSACTION_ERROR: 29189
01:48:52 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:52 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:52 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  922.795420] binder_alloc: 11112: binder_alloc_buf, no vma
01:48:52 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:52 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 7 printk messages dropped ** [  922.826995] binder: 11118:11119 ioctl c0306201 20000380 returned -22
01:48:52 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  922.827200] binder: undelivered TRANSACTION_ERROR: 29189
** 2 printk messages dropped ** [  922.907243] binder: 11129:11134 ioctl c0306201 200002c0 returned -14
[  922.907383] binder: undelivered TRANSACTION_ERROR: 29189
[  922.933445] binder_alloc: 11135: binder_alloc_buf, no vma
01:48:52 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:52 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  922.933490] binder: 11135:11136 transaction failed 29189/-3, size 24-8 line 3137
01:48:52 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 2 printk messages dropped ** [  922.936246] binder: 11135:11136 ioctl c0306201 20000380 returned -22
[  922.936658] binder: undelivered TRANSACTION_ERROR: 29189
[  923.003879] binder_alloc: 11149: binder_alloc_buf, no vma
[  923.003993] binder: 11149:11150 transaction failed 29189/-3, size 24-8 line 3137
01:48:52 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:52 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:52 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  923.004084] binder: 11149:11150 ioctl c0306201 200002c0 returned -14
[  923.004328] binder: undelivered TRANSACTION_ERROR: 29189
[  923.075583] binder_alloc: 11155: binder_alloc_buf, no vma
[  923.075629] binder: 11155:11156 transaction failed 29189/-3, size 24-8 line 3137
[  923.075773] binder: 11155:11156 Release 1 refcount change on invalid ref 1 ret -22
[  923.075779] binder: 11155:11156 unknown command -1073488791
[  923.075788] binder: 11155:11156 ioctl c0306201 20000380 returned -22
[  923.075941] binder: undelivered TRANSACTION_ERROR: 29189
[  923.092295] binder_alloc: 11158: binder_alloc_buf, no vma
[  923.092342] binder: 11158:11161 transaction failed 29189/-3, size 24-8 line 3137
[  923.092825] binder: 11158:11161 ioctl c0306201 200002c0 returned -14
[  923.092962] binder: undelivered TRANSACTION_ERROR: 29189
[  923.195468] binder_alloc: 11174: binder_alloc_buf, no vma
[  923.195515] binder: 11174:11177 transaction failed 29189/-3, size 24-8 line 3137
[  923.195678] binder: 11174:11177 Release 1 refcount change on invalid ref 1 ret -22
[  923.195684] binder: 11174:11177 unknown command -1073488791
[  923.195692] binder: 11174:11177 ioctl c0306201 20000380 returned -22
[  923.198709] binder: BINDER_SET_CONTEXT_MGR already set
[  923.198717] binder: 11176:11179 ioctl 40046207 0 returned -16
[  923.198878] binder_alloc: 11174: binder_alloc_buf, no vma
[  923.198922] binder: 11176:11179 transaction failed 29189/-3, size 24-8 line 3137
01:48:53 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:53 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  923.199008] binder: 11176:11179 ioctl c0306201 200002c0 returned -14
[  923.205245] binder: undelivered TRANSACTION_ERROR: 29189
01:48:53 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:53 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  923.205330] binder: undelivered TRANSACTION_ERROR: 29189
01:48:53 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:53 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:53 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  923.335137] binder_alloc: 11190: binder_alloc_buf, no vma
01:48:53 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:53 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:53 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:53 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:53 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  923.335182] binder: 11190:11192 transaction failed 29189/-3, size 24-8 line 3137
[  923.335327] binder: 11190:11192 Release 1 refcount change on invalid ref 1 ret -22
01:48:53 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:53 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:53 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:53 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:53 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  923.335334] binder: 11190:11192 unknown command -1073488791
01:48:53 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:53 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:53 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:53 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:53 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  923.335341] binder: 11190:11192 ioctl c0306201 20000380 returned -22
[  923.336109] binder: undelivered TRANSACTION_ERROR: 29189
01:48:53 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:53 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  923.353542] binder_alloc: 11194: binder_alloc_buf, no vma
[  923.353586] binder: 11194:11198 transaction failed 29189/-3, size 24-8 line 3137
01:48:53 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:53 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:53 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 4 printk messages dropped ** [  923.446151] binder: 11210:11213 Release 1 refcount change on invalid ref 1 ret -22
01:48:53 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:53 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:53 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:53 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 3 printk messages dropped ** [  923.478965] binder_alloc: 11211: binder_alloc_buf, no vma
** 5 printk messages dropped ** [  923.564903] binder: 11226:11229 Release 1 refcount change on invalid ref 1 ret -22
01:48:53 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:53 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:53 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:53 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:53 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 3 printk messages dropped ** [  923.632241] binder_alloc: 11232: binder_alloc_buf, no vma
01:48:53 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:53 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:53 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:53 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:53 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 5 printk messages dropped ** [  923.689556] binder: 11244:11247 Release 1 refcount change on invalid ref 1 ret -22
[  923.689563] binder: 11244:11247 unknown command -1073488791
01:48:53 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:54 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 8 printk messages dropped ** [  923.802760] binder: 11261:11263 Release 1 refcount change on invalid ref 1 ret -22
01:48:54 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:54 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:54 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  923.802768] binder: 11261:11263 unknown command -1073488791
01:48:54 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:54 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 9 printk messages dropped ** [  923.959333] binder: 11279:11285 unknown command -1073488791
01:48:54 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:54 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:54 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  923.959340] binder: 11279:11285 ioctl c0306201 20000380 returned -22
01:48:54 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:54 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:54 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:54 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 9 printk messages dropped ** [  924.077645] binder: 11301:11303 ioctl c0306201 20000380 returned -22
01:48:54 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:54 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:54 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:54 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  924.077787] binder: undelivered TRANSACTION_ERROR: 29189
** 2 printk messages dropped ** [  924.124490] binder: 11306:11309 ioctl c0306201 200002c0 returned -14
01:48:54 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:54 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:54 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:54 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:54 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:54 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 5 printk messages dropped ** [  924.186334] binder: 11317:11323 ioctl c0306201 20000380 returned -22
01:48:54 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:54 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:54 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 9 printk messages dropped ** [  924.326640] binder: 11338:11342 ioctl c0306201 20000380 returned -22
01:48:54 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:54 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:54 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:54 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 3 printk messages dropped ** [  924.343609] binder: 11346:11348 ioctl c0306201 200002c0 returned -14
01:48:54 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:54 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:54 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:54 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:54 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:54 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:54 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 9 printk messages dropped ** [  924.503853] binder: 11362:11364 ioctl c0306201 200002c0 returned -14
[  924.506706] binder: undelivered TRANSACTION_ERROR: 29189
[  924.607863] binder_alloc: 11376: binder_alloc_buf, no vma
01:48:54 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:54 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  924.607909] binder: 11376:11379 transaction failed 29189/-3, size 24-8 line 3137
01:48:54 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:54 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:54 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 6 printk messages dropped ** [  924.619636] binder: 11382:11385 ioctl c0306201 200002c0 returned -14
01:48:54 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:54 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  924.619754] binder: undelivered TRANSACTION_ERROR: 29189
01:48:54 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:54 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:54 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:55 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 10 printk messages dropped ** [  925.052858] binder_alloc: 11413: binder_alloc_buf, no vma
01:48:55 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:55 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  925.052905] binder: 11413:11417 transaction failed 29189/-3, size 24-8 line 3137
01:48:55 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:55 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:55 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:55 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 2 printk messages dropped ** [  925.288324] binder_alloc: 11424: binder_alloc_buf, no vma
** 5 printk messages dropped ** [  925.332539] binder: 11427:11435 Release 1 refcount change on invalid ref 1 ret -22
01:48:55 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:55 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:55 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:55 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:55 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:55 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  925.332546] binder: 11427:11435 unknown command -1073488791
01:48:55 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:55 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 8 printk messages dropped ** [  925.465106] binder: 11452:11455 Release 1 refcount change on invalid ref 1 ret -22
01:48:55 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:55 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:55 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:55 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:55 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 9 printk messages dropped ** [  925.582663] binder: 11469:11472 Release 1 refcount change on invalid ref 1 ret -22
01:48:55 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:55 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:55 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:55 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  925.582669] binder: 11469:11472 unknown command -1073488791
[  925.582677] binder: 11469:11472 ioctl c0306201 20000380 returned -22
01:48:55 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:55 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:55 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  925.582822] binder: undelivered TRANSACTION_ERROR: 29189
01:48:55 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:55 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:55 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:55 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 6 printk messages dropped ** [  925.692442] binder: 11485:11487 Release 1 refcount change on invalid ref 1 ret -22
** 5 printk messages dropped ** [  925.706947] binder: 11486:11488 ioctl c0306201 200002c0 returned -14
01:48:55 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:55 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:55 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:55 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 3 printk messages dropped ** [  925.837670] binder: 11504:11508 Release 1 refcount change on invalid ref 1 ret -22
01:48:55 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:55 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:55 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:55 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 8 printk messages dropped ** [  925.941060] binder: 11521:11522 transaction failed 29189/-3, size 24-8 line 3137
01:48:55 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:55 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:55 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 6 printk messages dropped ** [  925.976502] binder: 11527:11531 ioctl c0306201 200002c0 returned -14
01:48:55 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:55 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:55 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:55 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 9 printk messages dropped ** [  926.104934] binder: 11546:11549 ioctl c0306201 200002c0 returned -14
01:48:55 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:55 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:55 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:56 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:56 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 11 printk messages dropped ** [  926.266670] binder_alloc: 11567: binder_alloc_buf, no vma
01:48:56 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  926.266715] binder: 11567:11573 transaction failed 29189/-3, size 24-8 line 3137
01:48:56 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:56 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:56 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:56 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:56 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  926.266873] binder: 11567:11573 Release 1 refcount change on invalid ref 1 ret -22
** 3 printk messages dropped ** [  926.362980] binder_alloc: 11580: binder_alloc_buf, no vma
01:48:56 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:56 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:56 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 3 printk messages dropped ** [  926.363290] binder: 11580:11586 ioctl c0306201 20000380 returned -22
[  926.363522] binder: undelivered TRANSACTION_ERROR: 29189
01:48:56 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:56 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:56 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  926.390359] binder_alloc: 11584: binder_alloc_buf, no vma
[  926.390404] binder: 11584:11588 transaction failed 29189/-3, size 24-8 line 3137
01:48:56 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:56 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:56 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 8 printk messages dropped ** [  926.470939] binder: 11596:11603 Release 1 refcount change on invalid ref 1 ret -22
01:48:56 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:56 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:56 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:56 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  926.470945] binder: 11596:11603 unknown command -1073488791
** 9 printk messages dropped ** [  926.587689] binder: 11613:11618 unknown command -1073488791
01:48:56 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:56 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:56 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:56 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  926.587699] binder: 11613:11618 ioctl c0306201 20000380 returned -22
[  926.587872] binder: undelivered TRANSACTION_ERROR: 29189
01:48:56 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:56 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:56 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 1 printk messages dropped ** [  926.649952] binder: 11625:11627 transaction failed 29189/-3, size 24-8 line 3137
01:48:56 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:56 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:56 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:56 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 5 printk messages dropped ** [  926.706377] binder: 11633:11638 unknown command -1073488791
** 3 printk messages dropped ** [  926.829625] binder: 11640:11647 transaction failed 29189/-3, size 24-8 line 3137
01:48:56 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:56 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:56 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:56 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:56 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 5 printk messages dropped ** [  926.861721] binder: 11657:11659 unknown command -1073488791
[  926.861729] binder: 11657:11659 ioctl c0306201 20000380 returned -22
01:48:56 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:56 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:56 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:56 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:56 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 4 printk messages dropped ** [  926.937661] binder: 11668:11670 unknown command -1073488791
[  926.937669] binder: 11668:11670 ioctl c0306201 20000380 returned -22
01:48:56 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:56 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 2 printk messages dropped ** [  926.964604] binder: 11667:11675 transaction failed 29189/-3, size 24-8 line 3137
[  926.964721] binder: 11667:11675 ioctl c0306201 200002c0 returned -14
[  926.967169] binder: undelivered TRANSACTION_ERROR: 29189
01:48:56 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:56 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:56 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:56 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  927.059355] binder_alloc: 11683: binder_alloc_buf, no vma
** 6 printk messages dropped ** [  927.077547] binder: 11690:11692 transaction failed 29189/-3, size 24-8 line 3137
01:48:56 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:56 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:57 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:57 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  927.078440] binder: 11690:11692 ioctl c0306201 200002c0 returned -14
01:48:57 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 4 printk messages dropped ** [  927.182927] binder: undelivered TRANSACTION_ERROR: 29189
01:48:57 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:57 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:57 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:57 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:57 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 3 printk messages dropped ** [  927.188339] binder: 11702:11703 unknown command -1073488791
01:48:57 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 5 printk messages dropped ** [  927.279427] binder: undelivered TRANSACTION_ERROR: 29189
01:48:57 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:57 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:57 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:57 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:57 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:57 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  927.312120] binder_alloc: 11722: binder_alloc_buf, no vma
** 8 printk messages dropped ** [  927.410987] binder: undelivered TRANSACTION_ERROR: 29189
01:48:57 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:57 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:57 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:57 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  927.412373] binder_alloc: 11735: binder_alloc_buf, no vma
01:48:57 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:57 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 8 printk messages dropped ** [  927.531851] binder: 11754:11757 unknown command -1073488791
01:48:57 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:57 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:57 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:57 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:57 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 1 printk messages dropped ** [  927.532221] binder: undelivered TRANSACTION_ERROR: 29189
01:48:57 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:57 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:57 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:57 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:57 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 13 printk messages dropped ** [  927.693996] binder: undelivered TRANSACTION_ERROR: 29189
[  927.790316] binder_alloc: 11788: binder_alloc_buf, no vma
01:48:57 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:57 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:57 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  927.790362] binder: 11788:11794 transaction failed 29189/-3, size 24-8 line 3137
01:48:57 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:57 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 7 printk messages dropped ** [  927.803937] binder: undelivered TRANSACTION_ERROR: 29189
01:48:57 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:57 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  927.829135] binder_alloc: 11798: binder_alloc_buf, no vma
01:48:57 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:57 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:57 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:57 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 8 printk messages dropped ** [  927.971106] binder: 11812:11815 transaction failed 29189/-3, size 24-8 line 3137
01:48:57 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:57 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  927.971272] binder: 11812:11815 Release 1 refcount change on invalid ref 1 ret -22
01:48:57 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:57 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:57 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  927.971278] binder: 11812:11815 unknown command -1073488791
01:48:57 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:57 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:57 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 7 printk messages dropped ** [  928.072405] binder: 11833:11836 transaction failed 29189/-3, size 24-8 line 3137
01:48:58 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:58 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:58 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:58 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:58 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 1 printk messages dropped ** [  928.073461] binder: 11833:11836 unknown command -1073488791
01:48:58 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:58 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:58 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 9 printk messages dropped ** [  928.212824] binder: 11852:11857 unknown command -1073488791
01:48:58 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 5 printk messages dropped ** [  928.222159] binder: undelivered TRANSACTION_ERROR: 29189
[  928.333846] binder_alloc: 11872: binder_alloc_buf, no vma
[  928.333893] binder: 11872:11878 transaction failed 29189/-3, size 24-8 line 3137
01:48:58 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:58 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:58 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:58 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 3 printk messages dropped ** [  928.334507] binder: undelivered TRANSACTION_ERROR: 29189
** 3 printk messages dropped ** [  928.363838] binder: undelivered TRANSACTION_ERROR: 29189
01:48:58 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:58 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:58 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:58 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:58 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 5 printk messages dropped ** [  928.469370] binder: undelivered TRANSACTION_ERROR: 29189
01:48:58 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:58 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:58 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 3 printk messages dropped ** [  928.470296] binder: 11887:11895 ioctl c0306201 20000380 returned -22
01:48:58 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:58 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:58 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:58 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 9 printk messages dropped ** [  928.617769] binder: 11911:11915 ioctl c0306201 20000380 returned -22
01:48:58 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:58 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:58 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:58 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  928.617936] binder: undelivered TRANSACTION_ERROR: 29189
** 2 printk messages dropped ** [  928.672427] binder: 11921:11923 ioctl c0306201 200002c0 returned -14
01:48:58 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:58 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:58 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:58 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 5 printk messages dropped ** [  928.757745] binder: 11930:11932 ioctl c0306201 20000380 returned -22
01:48:59 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:59 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:59 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 3 printk messages dropped ** [  928.797474] binder: 11938:11939 ioctl c0306201 200002c0 returned -14
01:48:59 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:59 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:59 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:59 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 5 printk messages dropped ** [  928.890962] binder: 11951:11957 ioctl c0306201 20000380 returned -22
01:48:59 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:59 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:59 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:59 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 9 printk messages dropped ** [  929.032763] binder: 11968:11974 ioctl c0306201 20000380 returned -22
01:48:59 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:59 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:59 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 3 printk messages dropped ** [  929.044029] binder: 11975:11978 ioctl c0306201 200002c0 returned -14
01:48:59 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:59 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:59 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 5 printk messages dropped ** [  929.175628] binder: 11991:11996 ioctl c0306201 20000380 returned -22
01:48:59 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:59 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:59 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 3 printk messages dropped ** [  929.185829] binder: 11994:11998 ioctl c0306201 200002c0 returned -14
01:48:59 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:59 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:59 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:59 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  929.185967] binder: undelivered TRANSACTION_ERROR: 29189
[  929.301095] binder_alloc: 12013: binder_alloc_buf, no vma
01:48:59 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:59 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:59 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:59 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 9 printk messages dropped ** [  929.302806] binder: undelivered TRANSACTION_ERROR: 29189
[  929.303026] binder: undelivered TRANSACTION_ERROR: 29189
01:48:59 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:59 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:59 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:59 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:59 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 8 printk messages dropped ** [  929.447875] binder: 12031:12035 ioctl c0306201 200002c0 returned -14
01:48:59 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:59 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:59 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 3 printk messages dropped ** [  929.581978] binder: 12050:12053 Release 1 refcount change on invalid ref 1 ret -22
01:48:59 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:59 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:59 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 5 printk messages dropped ** [  929.604880] binder: 12051:12055 ioctl c0306201 200002c0 returned -14
01:48:59 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:59 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:48:59 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:59 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:59 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 9 printk messages dropped ** [  929.731292] binder: 12069:12073 ioctl c0306201 200002c0 returned -14
01:48:59 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:48:59 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  929.731418] binder: undelivered TRANSACTION_ERROR: 29189
** 4 printk messages dropped ** [  929.808188] binder: 12085:12088 ioctl c0306201 20000380 returned -22
01:48:59 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:59 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:48:59 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:48:59 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:48:59 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 3 printk messages dropped ** [  929.847282] binder: 12084:12090 ioctl c0306201 200002c0 returned -14
01:49:00 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:00 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:00 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:00 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 9 printk messages dropped ** [  929.962295] binder: 12102:12109 ioctl c0306201 20000380 returned -22
01:49:00 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:00 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:00 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  929.962459] binder: undelivered TRANSACTION_ERROR: 29189
** 4 printk messages dropped ** [  930.067582] binder_alloc: 12118: binder_alloc_buf, no vma
01:49:00 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:00 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:00 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:00 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 3 printk messages dropped ** [  930.077193] binder: 12118:12129 ioctl c0306201 20000380 returned -22
01:49:00 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:00 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:00 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:00 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 5 printk messages dropped ** [  930.171423] binder: 12137:12139 ioctl c0306201 20000380 returned -22
01:49:00 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:00 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 3 printk messages dropped ** [  930.177661] binder: 12138:12140 ioctl c0306201 200002c0 returned -14
01:49:00 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:00 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:00 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:00 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 5 printk messages dropped ** [  930.271504] binder: 12152:12156 ioctl c0306201 20000380 returned -22
01:49:00 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:00 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:00 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:00 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 3 printk messages dropped ** [  930.281903] binder: 12154:12157 ioctl c0306201 200002c0 returned -14
01:49:00 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:00 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:00 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:00 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 6 printk messages dropped ** [  930.643440] binder: undelivered TRANSACTION_ERROR: 29189
01:49:00 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:00 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 2 printk messages dropped ** [  930.710012] binder: undelivered TRANSACTION_ERROR: 29189
[  930.804552] binder_alloc: 12195: binder_alloc_buf, no vma
** 4 printk messages dropped ** [  930.805618] binder: undelivered TRANSACTION_ERROR: 29189
01:49:00 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:00 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:00 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:00 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  930.842699] binder_alloc: 12197: binder_alloc_buf, no vma
[  930.842745] binder: 12197:12204 transaction failed 29189/-3, size 24-8 line 3137
01:49:00 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:00 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:00 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 7 printk messages dropped ** [  930.940636] binder: undelivered TRANSACTION_ERROR: 29189
01:49:00 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:00 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:00 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:00 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 3 printk messages dropped ** [  930.985167] binder: undelivered TRANSACTION_ERROR: 29189
01:49:00 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:00 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:00 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:00 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:00 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 5 printk messages dropped ** [  931.099393] binder: undelivered TRANSACTION_ERROR: 29189
01:49:00 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:01 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 3 printk messages dropped ** [  931.174875] binder: undelivered TRANSACTION_ERROR: 29189
[  931.240473] binder_alloc: 12247: binder_alloc_buf, no vma
01:49:01 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:01 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:01 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:01 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  931.240517] binder: 12247:12249 transaction failed 29189/-3, size 24-8 line 3137
01:49:01 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:01 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 7 printk messages dropped ** [  931.344711] binder: undelivered TRANSACTION_ERROR: 29189
[  931.376331] binder_alloc: 12266: binder_alloc_buf, no vma
01:49:01 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:01 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  931.376375] binder: 12266:12274 transaction failed 29189/-3, size 24-8 line 3137
01:49:01 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 3 printk messages dropped ** [  931.379836] binder: undelivered TRANSACTION_ERROR: 29189
01:49:01 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:01 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:01 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:01 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 3 printk messages dropped ** [  931.453478] binder: undelivered TRANSACTION_ERROR: 29189
[  931.509310] binder_alloc: 12287: binder_alloc_buf, no vma
01:49:01 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:01 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:01 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 4 printk messages dropped ** [  931.510156] binder: undelivered TRANSACTION_ERROR: 29189
01:49:01 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:01 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 3 printk messages dropped ** [  931.577839] binder: undelivered TRANSACTION_ERROR: 29189
01:49:01 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:01 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:01 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  931.626747] binder_alloc: 12305: binder_alloc_buf, no vma
01:49:01 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:01 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:01 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 8 printk messages dropped ** [  931.664507] binder: undelivered TRANSACTION_ERROR: 29189
[  931.728843] binder_alloc: 12322: binder_alloc_buf, no vma
01:49:01 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:01 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  931.728889] binder: 12322:12326 transaction failed 29189/-3, size 24-8 line 3137
[  931.729041] binder: 12322:12326 Release 1 refcount change on invalid ref 1 ret -22
01:49:01 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:01 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:01 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:01 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:01 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 6 printk messages dropped ** [  931.796075] binder: undelivered TRANSACTION_ERROR: 29189
01:49:01 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:01 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:01 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 5 printk messages dropped ** [  931.817932] binder: undelivered TRANSACTION_ERROR: 29189
01:49:01 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:01 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  931.890140] binder_alloc: 12346: binder_alloc_buf, no vma
[  931.890197] binder: 12346:12347 transaction failed 29189/-3, size 24-8 line 3137
** 1 printk messages dropped ** [  931.890449] binder: undelivered TRANSACTION_ERROR: 29189
01:49:01 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:01 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:01 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:01 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:01 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 5 printk messages dropped ** [  931.920200] binder: undelivered TRANSACTION_ERROR: 29189
01:49:01 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:01 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 3 printk messages dropped ** [  931.989805] binder: 12361:12363 unknown command -1073488791
01:49:01 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:02 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:02 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  931.989814] binder: 12361:12363 ioctl c0306201 20000380 returned -22
01:49:02 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:02 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:02 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 8 printk messages dropped ** [  932.087437] binder: 12373:12375 unknown command -1073488791
[  932.087445] binder: 12373:12375 ioctl c0306201 20000380 returned -22
01:49:02 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:02 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:02 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  932.087607] binder: undelivered TRANSACTION_ERROR: 29189
[  932.118598] binder_alloc: 12376: binder_alloc_buf, no vma
01:49:02 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:02 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:02 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 6 printk messages dropped ** [  934.926652] binder: 12388:12391 unknown command -1073488791
[  934.926660] binder: 12388:12391 ioctl c0306201 20000380 returned -22
[  934.927075] binder: undelivered TRANSACTION_ERROR: 29189
01:49:02 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  934.933527] binder_alloc: 12389: binder_alloc_buf, no vma
01:49:02 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:02 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:02 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 2 printk messages dropped ** [  934.949405] binder: undelivered TRANSACTION_ERROR: 29189
01:49:02 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 3 printk messages dropped ** [  935.063598] binder: undelivered TRANSACTION_ERROR: 29189
[  935.064896] binder_alloc: 12406: binder_alloc_buf, no vma
01:49:02 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:02 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 4 printk messages dropped ** [  935.071248] binder: undelivered TRANSACTION_ERROR: 29189
01:49:02 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:02 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:02 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:02 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:02 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:02 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 3 printk messages dropped ** [  935.187236] binder: undelivered TRANSACTION_ERROR: 29189
[  935.238654] binder_alloc: 12429: binder_alloc_buf, no vma
[  935.238702] binder: 12429:12432 transaction failed 29189/-3, size 24-8 line 3137
01:49:02 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:02 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:02 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:02 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:02 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 7 printk messages dropped ** [  935.291014] binder: 12440:12441 unknown command -1073488791
[  935.291022] binder: 12440:12441 ioctl c0306201 20000380 returned -22
01:49:02 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:02 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:02 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 4 printk messages dropped ** [  935.343383] binder: undelivered TRANSACTION_ERROR: 29189
01:49:02 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:02 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:02 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:02 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:02 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:02 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 9 printk messages dropped ** [  935.440815] binder: undelivered TRANSACTION_ERROR: 29189
01:49:02 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  935.471407] binder_alloc: 12468: binder_alloc_buf, no vma
01:49:02 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:02 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:02 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:02 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:02 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 8 printk messages dropped ** [  935.533389] binder: undelivered TRANSACTION_ERROR: 29189
01:49:02 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:02 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:02 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  935.584685] binder_alloc: 12477: binder_alloc_buf, no vma
** 1 printk messages dropped ** [  935.584904] binder: 12477:12484 Release 1 refcount change on invalid ref 1 ret -22
01:49:02 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:02 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:03 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:03 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:03 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 6 printk messages dropped ** [  935.680857] binder: undelivered TRANSACTION_ERROR: 29189
01:49:03 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:03 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 5 printk messages dropped ** [  935.731038] binder: undelivered TRANSACTION_ERROR: 29189
01:49:03 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:03 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:03 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:03 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 3 printk messages dropped ** [  935.766658] binder: undelivered TRANSACTION_ERROR: 29189
01:49:03 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:03 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 9 printk messages dropped ** [  935.893405] binder: undelivered TRANSACTION_ERROR: 29189
01:49:03 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:03 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:03 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:03 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 5 printk messages dropped ** [  935.963014] binder: undelivered TRANSACTION_ERROR: 29189
01:49:03 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:03 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:03 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:03 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 3 printk messages dropped ** [  936.021038] binder: undelivered TRANSACTION_ERROR: 29189
01:49:03 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:03 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:03 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:03 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:03 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 5 printk messages dropped ** [  936.109504] binder: undelivered TRANSACTION_ERROR: 29189
01:49:03 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:03 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:03 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 5 printk messages dropped ** [  936.199661] binder: 12572:12575 transaction failed 29189/-3, size 24-8 line 3137
01:49:03 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:03 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:03 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:03 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 9 printk messages dropped ** [  936.312348] binder: 12588:12592 transaction failed 29189/-3, size 24-8 line 3137
[  936.312518] binder: 12588:12592 Release 1 refcount change on invalid ref 1 ret -22
[  936.312525] binder: 12588:12592 unknown command -1073488791
01:49:03 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:03 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  936.312533] binder: 12588:12592 ioctl c0306201 20000380 returned -22
[  936.312691] binder: undelivered TRANSACTION_ERROR: 29189
01:49:03 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:03 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 5 printk messages dropped ** [  936.423292] binder: 12603:12607 transaction failed 29189/-3, size 24-8 line 3137
01:49:03 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:04 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  936.423849] binder: 12603:12607 Release 1 refcount change on invalid ref 1 ret -22
01:49:04 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:04 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:04 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  936.423855] binder: 12603:12607 unknown command -1073488791
[  936.423863] binder: 12603:12607 ioctl c0306201 20000380 returned -22
01:49:04 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:04 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:04 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 6 printk messages dropped ** [  936.516105] binder: 12618:12623 transaction failed 29189/-3, size 24-8 line 3137
01:49:04 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:04 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:04 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  936.516263] binder: 12617:12621 Release 1 refcount change on invalid ref 1 ret -22
01:49:04 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:04 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:04 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 4 printk messages dropped ** [  936.521609] binder: undelivered TRANSACTION_ERROR: 29189
01:49:04 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:04 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:04 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 3 printk messages dropped ** [  936.629829] binder: 12633:12638 unknown command -1073488791
[  936.629838] binder: 12633:12638 ioctl c0306201 20000380 returned -22
01:49:04 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:04 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:04 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 8 printk messages dropped ** [  936.755740] binder: undelivered TRANSACTION_ERROR: 29189
01:49:04 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  936.764725] binder_alloc: 12653: binder_alloc_buf, no vma
[  936.764771] binder: 12653:12655 transaction failed 29189/-3, size 24-8 line 3137
01:49:04 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:04 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 1 printk messages dropped ** [  936.764947] binder: 12653:12655 unknown command -1073488791
01:49:04 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:04 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:04 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:04 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 5 printk messages dropped ** [  936.885614] binder: 12668:12675 unknown command -1073488791
[  936.885623] binder: 12668:12675 ioctl c0306201 20000380 returned -22
01:49:04 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:04 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:04 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:04 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:04 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 1 printk messages dropped ** [  936.906875] binder_alloc: 12672: binder_alloc_buf, no vma
01:49:04 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:04 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:04 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:04 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 6 printk messages dropped ** [  937.017291] binder: 12690:12691 unknown command -1073488791
01:49:04 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:04 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 3 printk messages dropped ** [  937.039407] binder: 12694:12700 transaction failed 29189/-3, size 24-8 line 3137
01:49:04 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:04 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:04 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:04 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:04 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 9 printk messages dropped ** [  937.195928] binder: 12718:12722 transaction failed 29189/-3, size 24-8 line 3137
01:49:04 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:04 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:04 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 5 printk messages dropped ** [  937.219106] binder: 12724:12726 unknown command -1073488791
01:49:04 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:04 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:05 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 9 printk messages dropped ** [  937.365274] binder: 12743:12745 unknown command -1073488791
01:49:05 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:05 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  937.365281] binder: 12743:12745 ioctl c0306201 20000380 returned -22
[  937.366113] binder: undelivered TRANSACTION_ERROR: 29189
01:49:05 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:05 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:05 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 3 printk messages dropped ** [  937.388024] binder: undelivered TRANSACTION_ERROR: 29189
01:49:05 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:05 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:05 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:05 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 3 printk messages dropped ** [  937.457355] binder: 12757:12761 unknown command -1073488791
01:49:05 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:05 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:05 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:05 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 9 printk messages dropped ** [  937.636249] binder: 12781:12785 unknown command -1073488791
01:49:05 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:05 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:05 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:05 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 3 printk messages dropped ** [  937.695925] binder: 12790:12796 transaction failed 29189/-3, size 24-8 line 3137
01:49:05 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:05 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:05 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:05 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:05 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 9 printk messages dropped ** [  937.814352] binder: 12809:12815 transaction failed 29189/-3, size 24-8 line 3137
[  937.814514] binder: 12809:12815 ioctl c0306201 200002c0 returned -14
01:49:05 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:05 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:05 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:05 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:05 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:05 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 8 printk messages dropped ** [  937.910519] binder: 12828:12831 transaction failed 29189/-3, size 24-8 line 3137
01:49:05 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:05 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:05 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 5 printk messages dropped ** [  938.052032] binder: 12846:12851 unknown command -1073488791
01:49:05 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:05 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:05 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 2 printk messages dropped ** [  938.066933] binder_alloc: 12850: binder_alloc_buf, no vma
[  938.066978] binder: 12850:12854 transaction failed 29189/-3, size 24-8 line 3137
01:49:05 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:05 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:05 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:05 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:05 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:05 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  938.068386] binder: 12850:12854 ioctl c0306201 200002c0 returned -14
** 4 printk messages dropped ** [  938.185397] binder: 12862:12871 unknown command -1073488791
** 3 printk messages dropped ** [  938.189517] binder: 12867:12872 transaction failed 29189/-3, size 24-8 line 3137
01:49:05 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:05 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:05 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:05 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:05 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  938.189630] binder: 12867:12872 ioctl c0306201 200002c0 returned -14
[  938.189764] binder: undelivered TRANSACTION_ERROR: 29189
** 1 printk messages dropped ** [  938.303390] binder: 12880:12886 transaction failed 29189/-3, size 24-8 line 3137
01:49:05 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:05 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:05 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  938.303492] binder: 12880:12886 ioctl c0306201 200002c0 returned -14
01:49:06 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:06 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:06 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 8 printk messages dropped ** [  938.425930] binder: 12901:12905 transaction failed 29189/-3, size 24-8 line 3137
01:49:06 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:06 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:06 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:06 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 5 printk messages dropped ** [  938.439510] binder: 12903:12908 unknown command -1073488791
01:49:06 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:06 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:06 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:06 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 3 printk messages dropped ** [  938.703663] binder: 12915:12916 transaction failed 29189/-3, size 24-8 line 3137
01:49:06 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:06 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:06 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 9 printk messages dropped ** [  938.946325] binder: 12924:12931 transaction failed 29189/-3, size 24-8 line 3137
01:49:06 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:06 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:06 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:06 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 9 printk messages dropped ** [  939.067283] binder: undelivered TRANSACTION_ERROR: 29189
01:49:06 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:06 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  939.080904] binder_alloc: 12940: binder_alloc_buf, no vma
[  939.080949] binder: 12940:12948 transaction failed 29189/-3, size 24-8 line 3137
01:49:06 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:06 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:06 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:06 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:06 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 7 printk messages dropped ** [  939.191935] binder: undelivered TRANSACTION_ERROR: 29189
01:49:06 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:06 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:06 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:06 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:06 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 9 printk messages dropped ** [  939.334010] binder: undelivered TRANSACTION_ERROR: 29189
01:49:06 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:06 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:06 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:06 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  939.341990] binder_alloc: 12978: binder_alloc_buf, no vma
** 4 printk messages dropped ** [  939.450912] binder: 12996:12998 transaction failed 29189/-3, size 24-8 line 3137
01:49:06 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:06 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:06 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:06 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:06 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:06 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 3 printk messages dropped ** [  939.451397] binder: undelivered TRANSACTION_ERROR: 29189
01:49:06 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:06 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:06 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 9 printk messages dropped ** [  939.568259] binder: undelivered TRANSACTION_ERROR: 29189
01:49:06 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:06 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:06 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:06 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:06 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  939.612026] binder_alloc: 13020: binder_alloc_buf, no vma
** 4 printk messages dropped ** [  939.683004] binder: 13031:13033 transaction failed 29189/-3, size 24-8 line 3137
01:49:06 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:06 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:07 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 3 printk messages dropped ** [  939.684561] binder: undelivered TRANSACTION_ERROR: 29189
01:49:07 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:07 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:07 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 9 printk messages dropped ** [  939.810468] binder: undelivered TRANSACTION_ERROR: 29189
01:49:07 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:07 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:07 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:07 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:07 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:07 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 3 printk messages dropped ** [  939.827437] binder: undelivered TRANSACTION_ERROR: 29189
[  939.946328] binder_alloc: 13068: binder_alloc_buf, no vma
01:49:07 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 4 printk messages dropped ** [  939.947433] binder: undelivered TRANSACTION_ERROR: 29189
01:49:07 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:07 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:07 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 3 printk messages dropped ** [  939.991088] binder: undelivered TRANSACTION_ERROR: 29189
[  940.039438] binder_alloc: 13083: binder_alloc_buf, no vma
01:49:07 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:07 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:07 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  940.039484] binder: 13083:13086 transaction failed 29189/-3, size 24-8 line 3137
** 1 printk messages dropped ** [  940.041388] binder: 13083:13086 unknown command -1073488791
01:49:07 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:07 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:07 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:07 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:07 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:07 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:07 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 5 printk messages dropped ** [  940.100442] binder: undelivered TRANSACTION_ERROR: 29189
** 9 printk messages dropped ** [  940.191803] binder: undelivered TRANSACTION_ERROR: 29189
01:49:07 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:07 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:07 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:07 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:07 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  940.310835] binder_alloc: 13124: binder_alloc_buf, no vma
[  940.310880] binder: 13124:13128 transaction failed 29189/-3, size 24-8 line 3137
01:49:07 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:07 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:07 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  940.311688] binder: 13124:13128 Release 1 refcount change on invalid ref 1 ret -22
01:49:07 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:07 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:07 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:07 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 2 printk messages dropped ** [  940.311975] binder: undelivered TRANSACTION_ERROR: 29189
01:49:07 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:07 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:07 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:07 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 3 printk messages dropped ** [  940.323497] binder: undelivered TRANSACTION_ERROR: 29189
[  940.440243] binder_alloc: 13135: binder_alloc_buf, no vma
01:49:07 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:07 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:07 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:07 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 8 printk messages dropped ** [  940.444982] binder: undelivered TRANSACTION_ERROR: 29189
01:49:07 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:07 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:07 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:07 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 9 printk messages dropped ** [  940.577725] binder: undelivered TRANSACTION_ERROR: 29189
01:49:07 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:07 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  940.689204] binder_alloc: 13172: binder_alloc_buf, no vma
01:49:08 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:08 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:08 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:08 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:08 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 2 printk messages dropped ** [  940.689758] binder: 13172:13177 unknown command -1073488791
01:49:08 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 5 printk messages dropped ** [  940.706618] binder: undelivered TRANSACTION_ERROR: 29189
01:49:08 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:08 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:08 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  940.846166] binder_alloc: 13194: binder_alloc_buf, no vma
01:49:08 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:08 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:08 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 8 printk messages dropped ** [  940.876742] binder: undelivered TRANSACTION_ERROR: 29189
[  940.965466] binder_alloc: 13216: binder_alloc_buf, no vma
01:49:08 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  940.965512] binder: 13216:13219 transaction failed 29189/-3, size 24-8 line 3137
01:49:08 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:08 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:08 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:08 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  940.966267] binder: 13216:13219 Release 1 refcount change on invalid ref 1 ret -22
01:49:08 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:08 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 4 printk messages dropped ** [  940.985356] binder: 13214:13221 transaction failed 29189/-3, size 24-8 line 3137
01:49:08 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:08 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:08 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:08 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 1 printk messages dropped ** [  940.986003] binder: undelivered TRANSACTION_ERROR: 29189
01:49:08 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:08 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:08 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 5 printk messages dropped ** [  941.106590] binder: undelivered TRANSACTION_ERROR: 29189
** 3 printk messages dropped ** [  941.145588] binder: undelivered TRANSACTION_ERROR: 29189
01:49:08 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:08 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:08 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  941.215275] binder_alloc: 13253: binder_alloc_buf, no vma
01:49:08 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:08 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:08 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 2 printk messages dropped ** [  941.215842] binder: undelivered TRANSACTION_ERROR: 29189
01:49:08 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 5 printk messages dropped ** [  941.240639] binder: undelivered TRANSACTION_ERROR: 29189
[  941.369479] binder_alloc: 13271: binder_alloc_buf, no vma
[  941.369524] binder: 13271:13272 transaction failed 29189/-3, size 24-8 line 3137
01:49:08 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:08 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:08 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  941.371203] binder: 13271:13272 ioctl c0306201 200002c0 returned -14
[  941.371342] binder: undelivered TRANSACTION_ERROR: 29189
[  941.377022] binder_alloc: 13270: binder_alloc_buf, no vma
01:49:08 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  941.377067] binder: 13270:13276 transaction failed 29189/-3, size 24-8 line 3137
[  941.377235] binder: 13270:13276 Release 1 refcount change on invalid ref 1 ret -22
01:49:08 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:08 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:08 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:08 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 2 printk messages dropped ** [  941.378109] binder: undelivered TRANSACTION_ERROR: 29189
01:49:08 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:08 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 5 printk messages dropped ** [  941.469871] binder: undelivered TRANSACTION_ERROR: 29189
[  941.478563] binder_alloc: 13286: binder_alloc_buf, no vma
** 3 printk messages dropped ** [  941.565800] binder_alloc: 13299: binder_alloc_buf, no vma
01:49:09 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:09 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:09 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 4 printk messages dropped ** [  941.571107] binder: undelivered TRANSACTION_ERROR: 29189
[  941.602478] binder_alloc: 13303: binder_alloc_buf, no vma
[  941.602522] binder: 13303:13306 transaction failed 29189/-3, size 24-8 line 3137
[  941.602616] binder: 13303:13306 ioctl c0306201 200002c0 returned -14
[  941.607333] binder: undelivered TRANSACTION_ERROR: 29189
[  941.714251] binder_alloc: 13318: binder_alloc_buf, no vma
01:49:09 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:09 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  941.714299] binder: 13318:13319 transaction failed 29189/-3, size 24-8 line 3137
[  941.714511] binder: 13318:13319 Release 1 refcount change on invalid ref 1 ret -22
[  941.714518] binder: 13318:13319 unknown command -1073488791
[  941.714527] binder: 13318:13319 ioctl c0306201 20000380 returned -22
[  941.714675] binder: undelivered TRANSACTION_ERROR: 29189
[  941.758844] binder_alloc: 13320: binder_alloc_buf, no vma
[  941.758890] binder: 13320:13330 transaction failed 29189/-3, size 24-8 line 3137
[  941.758993] binder: 13320:13330 ioctl c0306201 200002c0 returned -14
[  941.764057] binder: undelivered TRANSACTION_ERROR: 29189
[  941.838431] binder_alloc: 13336: binder_alloc_buf, no vma
[  941.838477] binder: 13336:13340 transaction failed 29189/-3, size 24-8 line 3137
[  941.845579] binder: 13336:13340 Release 1 refcount change on invalid ref 1 ret -22
[  941.845587] binder: 13336:13340 unknown command -1073488791
[  941.845596] binder: 13336:13340 ioctl c0306201 20000380 returned -22
01:49:09 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:09 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  941.845756] binder: undelivered TRANSACTION_ERROR: 29189
[  941.874079] binder_alloc: 13342: binder_alloc_buf, no vma
[  941.874122] binder: 13342:13347 transaction failed 29189/-3, size 24-8 line 3137
[  941.874241] binder: 13342:13347 ioctl c0306201 200002c0 returned -14
[  941.874377] binder: undelivered TRANSACTION_ERROR: 29189
[  941.973644] binder_alloc: 13356: binder_alloc_buf, no vma
01:49:09 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:09 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  941.973690] binder: 13356:13357 transaction failed 29189/-3, size 24-8 line 3137
01:49:09 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:09 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:09 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:09 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  941.974275] binder: 13356:13357 Release 1 refcount change on invalid ref 1 ret -22
[  941.974282] binder: 13356:13357 unknown command -1073488791
01:49:09 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:09 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:09 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:09 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:09 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  941.974291] binder: 13356:13357 ioctl c0306201 20000380 returned -22
01:49:09 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:09 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  941.974445] binder: undelivered TRANSACTION_ERROR: 29189
[  941.989695] binder_alloc: 13360: binder_alloc_buf, no vma
01:49:09 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:09 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:09 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:09 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  941.989740] binder: 13360:13363 transaction failed 29189/-3, size 24-8 line 3137
01:49:09 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  941.989844] binder: 13360:13363 ioctl c0306201 200002c0 returned -14
01:49:09 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:09 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:09 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:09 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  941.989978] binder: undelivered TRANSACTION_ERROR: 29189
01:49:09 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:09 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 5 printk messages dropped ** [  942.104793] binder: undelivered TRANSACTION_ERROR: 29189
[  942.111369] binder_alloc: 13375: binder_alloc_buf, no vma
01:49:09 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:09 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:10 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:10 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  942.111415] binder: 13375:13381 transaction failed 29189/-3, size 24-8 line 3137
01:49:10 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:10 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:10 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 7 printk messages dropped ** [  942.226518] binder: undelivered TRANSACTION_ERROR: 29189
[  942.245020] binder_alloc: 13393: binder_alloc_buf, no vma
01:49:10 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:10 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:10 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:10 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:10 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 8 printk messages dropped ** [  942.344274] binder: 13410:13415 transaction failed 29189/-3, size 24-8 line 3137
01:49:10 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:10 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:10 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:10 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 5 printk messages dropped ** [  942.345774] binder: undelivered TRANSACTION_ERROR: 29189
[  942.458259] binder_alloc: 13425: binder_alloc_buf, no vma
[  942.458305] binder: 13425:13429 transaction failed 29189/-3, size 24-8 line 3137
01:49:10 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:10 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 1 printk messages dropped ** [  942.459472] binder: undelivered TRANSACTION_ERROR: 29189
01:49:10 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:10 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:10 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 5 printk messages dropped ** [  942.494133] binder: undelivered TRANSACTION_ERROR: 29189
01:49:10 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  942.588215] binder: BINDER_SET_CONTEXT_MGR already set
01:49:10 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:10 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:10 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 4 printk messages dropped ** [  942.588570] binder: 13446:13447 unknown command -1073488791
01:49:10 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:10 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:10 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:10 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:10 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 9 printk messages dropped ** [  942.671714] binder: 13460:13462 unknown command -1073488791
01:49:10 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:10 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:10 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:10 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 4 printk messages dropped ** [  942.718315] binder: 13464:13469 ioctl c0306201 200002c0 returned -14
[  942.718459] binder: undelivered TRANSACTION_ERROR: 29189
01:49:10 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:10 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:10 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 3 printk messages dropped ** [  942.779614] binder: 13475:13479 unknown command -1073488791
01:49:10 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:10 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:10 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:10 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 4 printk messages dropped ** [  942.829127] binder: 13482:13483 ioctl c0306201 200002c0 returned -14
01:49:10 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:10 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:10 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:10 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:10 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 9 printk messages dropped ** [  942.908688] binder: 13494:13500 ioctl c0306201 200002c0 returned -14
[  942.911531] binder: undelivered TRANSACTION_ERROR: 29189
** 4 printk messages dropped ** [  943.037040] binder_alloc: 13513: binder_alloc_buf, no vma
[  943.037084] binder: 13513:13520 transaction failed 29189/-3, size 24-8 line 3137
01:49:10 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  943.037259] binder: 13513:13520 Release 1 refcount change on invalid ref 1 ret -22
01:49:10 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:10 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:11 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:11 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  943.037265] binder: 13513:13520 unknown command -1073488791
01:49:11 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:11 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 6 printk messages dropped ** [  943.180467] binder_alloc: 13530: binder_alloc_buf, no vma
01:49:11 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:11 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:11 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:11 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:11 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  943.180514] binder: 13530:13536 transaction failed 29189/-3, size 24-8 line 3137
01:49:11 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:11 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 10 printk messages dropped ** [  943.316241] binder: 13550:13555 Release 1 refcount change on invalid ref 1 ret -22
01:49:11 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:11 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:11 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:11 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 9 printk messages dropped ** [  943.427934] binder: 13568:13573 Release 1 refcount change on invalid ref 1 ret -22
01:49:11 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:11 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:11 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  943.427940] binder: 13568:13573 unknown command -1073488791
[  943.427949] binder: 13568:13573 ioctl c0306201 20000380 returned -22
01:49:11 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:11 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:11 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:11 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:11 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 7 printk messages dropped ** [  943.571261] binder: 13583:13588 Release 1 refcount change on invalid ref 1 ret -22
01:49:11 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:11 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  943.571269] binder: 13583:13588 unknown command -1073488791
[  943.571280] binder: 13583:13588 ioctl c0306201 20000380 returned -22
01:49:11 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:11 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:11 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 3 printk messages dropped ** [  943.647469] binder: 13600:13602 ioctl c0306201 200002c0 returned -14
01:49:11 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 3 printk messages dropped ** [  943.697117] binder: 13599:13607 Release 1 refcount change on invalid ref 1 ret -22
[  943.697124] binder: 13599:13607 unknown command -1073488791
01:49:11 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:11 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:11 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:11 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 7 printk messages dropped ** [  943.845334] binder: 13626:13627 transaction failed 29189/-3, size 24-8 line 3137
01:49:11 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:11 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:11 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:11 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  943.845498] binder: 13626:13627 Release 1 refcount change on invalid ref 1 ret -22
01:49:11 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:11 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:11 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:11 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 9 printk messages dropped ** [  943.953755] binder: 13641:13646 Release 1 refcount change on invalid ref 1 ret -22
[  943.953762] binder: 13641:13646 unknown command -1073488791
01:49:11 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:11 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  943.953770] binder: 13641:13646 ioctl c0306201 20000380 returned -22
01:49:11 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:11 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:11 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 3 printk messages dropped ** [  944.019636] binder: 13650:13654 ioctl c0306201 200002c0 returned -14
01:49:11 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:12 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:12 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 4 printk messages dropped ** [  944.077786] binder: 13661:13664 unknown command -1073488791
01:49:12 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:12 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:12 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:12 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:12 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 4 printk messages dropped ** [  944.289168] binder: 13674:13675 ioctl c0306201 200002c0 returned -14
** 4 printk messages dropped ** [  944.484647] binder: 13681:13682 unknown command -1073488791
01:49:12 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:12 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:12 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:12 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  944.484654] binder: 13681:13682 ioctl c0306201 20000380 returned -22
01:49:12 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:12 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 8 printk messages dropped ** [  944.561190] binder: 13691:13696 unknown command -1073488791
01:49:12 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:12 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:12 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:12 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 4 printk messages dropped ** [  944.649549] binder: 13702:13703 ioctl c0306201 200002c0 returned -14
01:49:12 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:12 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:12 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  944.649865] binder: undelivered TRANSACTION_ERROR: 29189
** 9 printk messages dropped ** [  944.713954] binder: 13718:13720 unknown command -1073488791
01:49:12 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:12 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:12 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:12 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:12 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  944.713963] binder: 13718:13720 ioctl c0306201 20000380 returned -22
01:49:12 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:12 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:12 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:12 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 2 printk messages dropped ** [  944.749808] binder: 13717:13719 transaction failed 29189/-3, size 24-8 line 3137
01:49:12 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:12 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:12 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 9 printk messages dropped ** [  944.883438] binder: 13737:13741 transaction failed 29189/-3, size 24-8 line 3137
01:49:12 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:12 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:12 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:12 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:12 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 5 printk messages dropped ** [  944.929648] binder: 13743:13746 unknown command -1073488791
01:49:12 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:12 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:12 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 3 printk messages dropped ** [  945.018597] binder: 13753:13760 transaction failed 29189/-3, size 24-8 line 3137
01:49:12 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:12 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:12 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:12 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 10 printk messages dropped ** [  945.159617] binder: 13778:13779 Release 1 refcount change on invalid ref 1 ret -22
01:49:12 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:12 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:12 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:12 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 5 printk messages dropped ** [  945.173825] binder: 13776:13784 ioctl c0306201 200002c0 returned -14
01:49:12 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:12 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:12 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:13 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:13 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:13 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 8 printk messages dropped ** [  945.319991] binder: 13801:13804 unknown command -1073488791
01:49:13 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:13 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:13 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 4 printk messages dropped ** [  945.424857] binder: 13814:13819 ioctl c0306201 200002c0 returned -14
01:49:13 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:13 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:13 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:13 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:13 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  945.425019] binder: undelivered TRANSACTION_ERROR: 29189
** 2 printk messages dropped ** [  945.451743] binder: 13821:13823 Release 1 refcount change on invalid ref 1 ret -22
01:49:13 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:13 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:13 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 5 printk messages dropped ** [  945.552044] binder: BINDER_SET_CONTEXT_MGR already set
[  945.552052] binder: 13834:13839 ioctl 40046207 0 returned -16
01:49:13 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:13 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 8 printk messages dropped ** [  945.653711] binder_alloc: 13850: binder_alloc_buf, no vma
01:49:13 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:13 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:13 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  945.653753] binder: 13850:13853 transaction failed 29189/-3, size 24-8 line 3137
[  945.676938] binder: 13850:13853 ioctl c0306201 200002c0 returned -14
01:49:13 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:13 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:13 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 7 printk messages dropped ** [  945.800102] binder_alloc: 13870: binder_alloc_buf, no vma
[  945.800147] binder: 13870:13874 transaction failed 29189/-3, size 24-8 line 3137
[  945.800835] binder: 13870:13874 Release 1 refcount change on invalid ref 1 ret -22
01:49:13 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:13 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  945.800841] binder: 13870:13874 unknown command -1073488791
01:49:13 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:13 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:13 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 6 printk messages dropped ** [  945.928005] binder: 13889:13890 transaction failed 29189/-3, size 24-8 line 3137
01:49:13 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:13 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:13 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:13 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  945.928162] binder: 13889:13890 Release 1 refcount change on invalid ref 1 ret -22
01:49:13 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:13 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:13 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:13 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 8 printk messages dropped ** [  946.059257] binder: 13908:13913 transaction failed 29189/-3, size 24-8 line 3137
01:49:13 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:13 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:13 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 5 printk messages dropped ** [  946.162627] binder: 13923:13924 transaction failed 29189/-3, size 24-8 line 3137
01:49:13 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:13 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:13 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 3 printk messages dropped ** [  946.179411] binder: 13927:13933 transaction failed 29189/-3, size 24-8 line 3137
01:49:13 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:13 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:13 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 9 printk messages dropped ** [  946.297883] binder: undelivered TRANSACTION_ERROR: 29189
01:49:14 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:14 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:14 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:14 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:14 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:14 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  946.326341] binder_alloc: 13950: binder_alloc_buf, no vma
** 8 printk messages dropped ** [  946.400882] binder: 13962:13965 transaction failed 29189/-3, size 24-8 line 3137
01:49:14 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:14 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  946.401391] binder: 13962:13965 Release 1 refcount change on invalid ref 1 ret -22
01:49:14 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:14 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:14 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 2 printk messages dropped ** [  946.401703] binder: undelivered TRANSACTION_ERROR: 29189
01:49:14 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:14 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:14 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:14 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:14 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 9 printk messages dropped ** [  946.531417] binder: undelivered TRANSACTION_ERROR: 29189
01:49:14 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  946.598981] binder_alloc: 13992: binder_alloc_buf, no vma
01:49:14 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:14 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:14 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:14 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 8 printk messages dropped ** [  946.708832] binder: 14005:14011 transaction failed 29189/-3, size 24-8 line 3137
01:49:14 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:14 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:14 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:14 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:14 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  946.710692] binder: 14005:14011 Release 1 refcount change on invalid ref 1 ret -22
01:49:14 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 8 printk messages dropped ** [  946.959494] binder: undelivered TRANSACTION_ERROR: 29189
01:49:14 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:14 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:14 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:14 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:14 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 5 printk messages dropped ** [  947.097090] binder: 14061:14065 transaction failed 29189/-3, size 24-8 line 3137
[  947.098187] binder: 14061:14065 Release 1 refcount change on invalid ref 1 ret -22
[  947.098193] binder: 14061:14065 unknown command -1073488791
[  947.098202] binder: 14061:14065 ioctl c0306201 20000380 returned -22
[  947.098363] binder: undelivered TRANSACTION_ERROR: 29189
[  947.150631] binder_alloc: 14071: binder_alloc_buf, no vma
[  947.150678] binder: 14071:14074 transaction failed 29189/-3, size 24-8 line 3137
[  947.150782] binder: 14071:14074 ioctl c0306201 200002c0 returned -14
[  947.150912] binder: undelivered TRANSACTION_ERROR: 29189
[  947.246714] binder_alloc: 14081: binder_alloc_buf, no vma
[  947.246760] binder: 14081:14085 transaction failed 29189/-3, size 24-8 line 3137
[  947.246915] binder: 14081:14085 Release 1 refcount change on invalid ref 1 ret -22
[  947.246921] binder: 14081:14085 unknown command -1073488791
[  947.246929] binder: 14081:14085 ioctl c0306201 20000380 returned -22
01:49:15 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  947.247076] binder: undelivered TRANSACTION_ERROR: 29189
[  947.318076] binder_alloc: 14091: binder_alloc_buf, no vma
[  947.318132] binder: 14091:14094 transaction failed 29189/-3, size 24-8 line 3137
01:49:15 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:15 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:15 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:15 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:15 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:15 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  947.318236] binder: 14091:14094 ioctl c0306201 200002c0 returned -14
[  947.318475] binder: undelivered TRANSACTION_ERROR: 29189
01:49:15 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:15 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:15 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:15 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:15 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  947.379696] binder_alloc: 14102: binder_alloc_buf, no vma
[  947.379743] binder: 14102:14107 transaction failed 29189/-3, size 24-8 line 3137
01:49:15 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:15 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:15 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:15 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  947.380291] binder: 14102:14107 Release 1 refcount change on invalid ref 1 ret -22
01:49:15 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:15 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:15 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:15 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 8 printk messages dropped ** [  947.521647] binder: 14121:14123 transaction failed 29189/-3, size 24-8 line 3137
01:49:15 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:15 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:15 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:15 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 3 printk messages dropped ** [  947.522032] binder: undelivered TRANSACTION_ERROR: 29189
01:49:15 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:15 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:15 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:15 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 5 printk messages dropped ** [  947.621857] binder: 14140:14145 transaction failed 29189/-3, size 24-8 line 3137
01:49:15 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:15 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:15 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:15 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:15 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:15 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 9 printk messages dropped ** [  947.720582] binder: 14157:14159 transaction failed 29189/-3, size 24-8 line 3137
01:49:15 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:15 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:15 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:15 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 9 printk messages dropped ** [  947.846574] binder: 14172:14176 transaction failed 29189/-3, size 24-8 line 3137
01:49:15 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:15 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:15 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:15 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 3 printk messages dropped ** [  947.871418] binder: 14177:14181 transaction failed 29189/-3, size 24-8 line 3137
01:49:15 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:15 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:15 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 5 printk messages dropped ** [  947.985798] binder: 14190:14195 transaction failed 29189/-3, size 24-8 line 3137
01:49:15 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:15 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:15 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:16 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 12 printk messages dropped ** [  948.089687] binder: 14208:14211 ioctl c0306201 20000380 returned -22
01:49:16 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:16 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:16 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:16 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:16 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 4 printk messages dropped ** [  948.108619] binder: undelivered TRANSACTION_ERROR: 29189
01:49:16 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:16 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 1 printk messages dropped ** [  948.222387] binder: 14230:14234 transaction failed 29189/-3, size 24-8 line 3137
01:49:16 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:16 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:16 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:16 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 3 printk messages dropped ** [  948.223757] binder: 14226:14231 transaction failed 29189/-3, size 24-8 line 3137
01:49:16 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:16 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:16 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:16 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:16 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:16 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 9 printk messages dropped ** [  948.304922] binder: 14243:14245 unknown command -1073488791
01:49:16 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:16 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:16 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:16 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 3 printk messages dropped ** [  948.365902] binder: 14252:14255 transaction failed 29189/-3, size 24-8 line 3137
01:49:16 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:16 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 8 printk messages dropped ** [  948.484221] binder_alloc: 14270: binder_alloc_buf, no vma
01:49:16 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:16 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:16 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:16 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:16 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  948.484266] binder: 14270:14273 transaction failed 29189/-3, size 24-8 line 3137
[  948.484519] binder: 14270:14273 ioctl c0306201 200002c0 returned -14
01:49:16 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:16 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 8 printk messages dropped ** [  948.622955] binder: 14285:14295 transaction failed 29189/-3, size 24-8 line 3137
01:49:16 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:16 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:16 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:16 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 1 printk messages dropped ** [  948.623111] binder: 14285:14295 unknown command -1073488791
01:49:16 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:16 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:16 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:16 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:16 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:16 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 7 printk messages dropped ** [  948.749036] binder: 14307:14310 transaction failed 29189/-3, size 24-8 line 3137
** 5 printk messages dropped ** [  948.821581] binder: 14311:14315 unknown command -1073488791
01:49:16 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:16 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:16 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:16 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 3 printk messages dropped ** [  948.895300] binder: 14324:14328 transaction failed 29189/-3, size 24-8 line 3137
01:49:16 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:16 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 5 printk messages dropped ** [  949.067324] binder: 14350:14352 transaction failed 29189/-3, size 24-8 line 3137
01:49:17 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:17 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:17 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:17 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:17 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:17 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:17 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 9 printk messages dropped ** [  949.195600] binder: 14370:14372 transaction failed 29189/-3, size 24-8 line 3137
[  949.195707] binder: 14370:14372 ioctl c0306201 200002c0 returned -14
01:49:17 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:17 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:17 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:17 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:17 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  949.195848] binder: undelivered TRANSACTION_ERROR: 29189
** 7 printk messages dropped ** [  949.344859] binder: 14394:14396 transaction failed 29189/-3, size 24-8 line 3137
01:49:17 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:17 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:17 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:17 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:17 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:17 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  949.345259] binder: 14394:14396 Release 1 refcount change on invalid ref 1 ret -22
01:49:17 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:17 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:17 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 8 printk messages dropped ** [  949.439590] binder: 14407:14409 transaction failed 29189/-3, size 24-8 line 3137
01:49:17 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:17 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  949.439699] binder: 14407:14409 ioctl c0306201 200002c0 returned -14
01:49:17 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:17 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:17 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 8 printk messages dropped ** [  949.561825] binder: 14423:14428 transaction failed 29189/-3, size 24-8 line 3137
01:49:17 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:17 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:17 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:17 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:17 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 5 printk messages dropped ** [  949.787292] binder: 14427:14430 unknown command -1073488791
** 3 printk messages dropped ** [  950.074214] binder: 14447:14450 transaction failed 29189/-3, size 24-8 line 3137
01:49:17 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:17 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:17 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:17 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:17 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 7 printk messages dropped ** [  950.097815] binder: undelivered TRANSACTION_ERROR: 29189
01:49:17 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:17 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:17 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 1 printk messages dropped ** [  950.219940] binder: 14467:14471 transaction failed 29189/-3, size 24-8 line 3137
01:49:17 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:17 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:17 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 5 printk messages dropped ** [  950.227297] binder: 14468:14472 unknown command -1073488791
[  950.227305] binder: 14468:14472 ioctl c0306201 20000380 returned -22
01:49:17 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:17 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:17 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 2 printk messages dropped ** [  950.301911] binder: 14481:14484 transaction failed 29189/-3, size 24-8 line 3137
01:49:17 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:17 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:18 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 9 printk messages dropped ** [  950.465039] binder: 14500:14504 transaction failed 29189/-3, size 24-8 line 3137
01:49:18 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:18 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  950.465142] binder: 14500:14504 ioctl c0306201 200002c0 returned -14
01:49:18 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:18 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  950.465295] binder: undelivered TRANSACTION_ERROR: 29189
01:49:18 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:18 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:18 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 3 printk messages dropped ** [  950.482929] binder: 14506:14510 unknown command -1073488791
** 3 printk messages dropped ** [  950.585165] binder: 14522:14525 transaction failed 29189/-3, size 24-8 line 3137
01:49:18 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:18 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:18 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:18 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:18 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:18 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 5 printk messages dropped ** [  950.635096] binder: 14524:14528 unknown command -1073488791
** 3 printk messages dropped ** [  950.716211] binder: 14539:14542 transaction failed 29189/-3, size 24-8 line 3137
[  950.717214] binder: 14539:14542 ioctl c0306201 200002c0 returned -14
01:49:18 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:18 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:18 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  950.717368] binder: undelivered TRANSACTION_ERROR: 29189
01:49:18 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:18 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:18 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 1 printk messages dropped ** [  950.767726] binder: 14544:14547 transaction failed 29189/-3, size 24-8 line 3137
** 5 printk messages dropped ** [  950.878716] binder: 14559:14562 transaction failed 29189/-3, size 24-8 line 3137
01:49:18 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:18 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:18 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:18 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:18 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 3 printk messages dropped ** [  950.889565] binder: 14561:14567 transaction failed 29189/-3, size 24-8 line 3137
01:49:18 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:18 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:18 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 9 printk messages dropped ** [  951.030045] binder: 14581:14586 transaction failed 29189/-3, size 24-8 line 3137
01:49:18 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:18 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:18 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:18 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:18 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  951.030227] binder: 14581:14586 Release 1 refcount change on invalid ref 1 ret -22
** 8 printk messages dropped ** [  951.137852] binder: 14598:14603 transaction failed 29189/-3, size 24-8 line 3137
01:49:18 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:18 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:18 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:18 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:18 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:18 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 5 printk messages dropped ** [  951.141417] binder: undelivered TRANSACTION_ERROR: 29189
01:49:18 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:18 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 3 printk messages dropped ** [  951.252340] binder: undelivered TRANSACTION_ERROR: 29189
01:49:18 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:18 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:18 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 5 printk messages dropped ** [  951.297423] binder: undelivered TRANSACTION_ERROR: 29189
** 3 printk messages dropped ** [  951.383534] binder: undelivered TRANSACTION_ERROR: 29189
[  951.428667] binder_alloc: 14640: binder_alloc_buf, no vma
01:49:18 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:18 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  951.428713] binder: 14640:14646 transaction failed 29189/-3, size 24-8 line 3137
01:49:18 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:18 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:19 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:19 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 7 printk messages dropped ** [  951.466949] binder: undelivered TRANSACTION_ERROR: 29189
[  951.575019] binder_alloc: 14664: binder_alloc_buf, no vma
[  951.575063] binder: 14664:14670 transaction failed 29189/-3, size 24-8 line 3137
01:49:19 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:19 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:19 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  951.575244] binder: 14664:14670 ioctl c0306201 200002c0 returned -14
[  951.575382] binder: undelivered TRANSACTION_ERROR: 29189
01:49:19 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:19 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:19 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  951.607850] binder_alloc: 14659: binder_alloc_buf, no vma
[  951.607896] binder: 14659:14671 transaction failed 29189/-3, size 24-8 line 3137
01:49:19 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:19 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:19 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:19 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:19 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 3 printk messages dropped ** [  951.608242] binder: undelivered TRANSACTION_ERROR: 29189
01:49:19 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:19 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 9 printk messages dropped ** [  951.751237] binder: undelivered TRANSACTION_ERROR: 29189
01:49:19 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:19 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:19 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:19 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  951.866351] binder_alloc: 14703: binder_alloc_buf, no vma
[  951.866402] binder: 14703:14707 transaction failed 29189/-3, size 24-8 line 3137
01:49:19 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:19 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:19 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 7 printk messages dropped ** [  951.874533] binder: undelivered TRANSACTION_ERROR: 29189
01:49:19 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:19 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:19 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:19 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:19 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 5 printk messages dropped ** [  951.964814] binder: undelivered TRANSACTION_ERROR: 29189
01:49:19 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:19 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:19 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:19 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 3 printk messages dropped ** [  952.000007] binder: 14722:14725 unknown command -1073488791
01:49:19 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:19 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:19 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:19 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:19 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 9 printk messages dropped ** [  952.155865] binder: 14745:14751 transaction failed 29189/-3, size 24-8 line 3137
[  952.159321] binder: 14745:14751 ioctl c0306201 200002c0 returned -14
[  952.159464] binder: undelivered TRANSACTION_ERROR: 29189
01:49:19 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:19 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  952.249695] binder_alloc: 14765: binder_alloc_buf, no vma
[  952.249740] binder: 14765:14769 transaction failed 29189/-3, size 24-8 line 3137
** 7 printk messages dropped ** [  952.260760] binder: undelivered TRANSACTION_ERROR: 29189
01:49:19 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:19 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:19 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:19 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  952.414473] binder_alloc: 14781: binder_alloc_buf, no vma
01:49:19 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:19 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:19 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:19 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  952.414517] binder: 14781:14783 transaction failed 29189/-3, size 24-8 line 3137
01:49:19 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:19 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 8 printk messages dropped ** [  952.506159] binder_alloc: 14798: binder_alloc_buf, no vma
01:49:19 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:20 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  952.506205] binder: 14798:14805 transaction failed 29189/-3, size 24-8 line 3137
01:49:20 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:20 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:20 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 8 printk messages dropped ** [  952.590927] binder_alloc: 14810: binder_alloc_buf, no vma
[  952.590972] binder: 14810:14813 transaction failed 29189/-3, size 24-8 line 3137
[  952.591149] binder: 14810:14813 Release 1 refcount change on invalid ref 1 ret -22
[  952.591156] binder: 14810:14813 unknown command -1073488791
[  952.591164] binder: 14810:14813 ioctl c0306201 20000380 returned -22
[  952.591309] binder: undelivered TRANSACTION_ERROR: 29189
[  952.640657] binder_alloc: 14821: binder_alloc_buf, no vma
[  952.640703] binder: 14821:14825 transaction failed 29189/-3, size 24-8 line 3137
[  952.654298] binder: 14821:14825 ioctl c0306201 200002c0 returned -14
[  952.654459] binder: undelivered TRANSACTION_ERROR: 29189
[  952.677149] binder_alloc: 14826: binder_alloc_buf, no vma
[  952.677195] binder: 14826:14828 transaction failed 29189/-3, size 24-8 line 3137
01:49:20 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  952.679378] binder: 14826:14828 Release 1 refcount change on invalid ref 1 ret -22
[  952.679385] binder: 14826:14828 unknown command -1073488791
[  952.679393] binder: 14826:14828 ioctl c0306201 20000380 returned -22
[  952.679547] binder: undelivered TRANSACTION_ERROR: 29189
[  952.745687] binder_alloc: 14835: binder_alloc_buf, no vma
[  952.745730] binder: 14835:14839 transaction failed 29189/-3, size 24-8 line 3137
[  952.745838] binder: 14835:14839 ioctl c0306201 200002c0 returned -14
[  952.746630] binder: undelivered TRANSACTION_ERROR: 29189
[  952.751536] binder_alloc: 14838: binder_alloc_buf, no vma
01:49:20 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  952.751580] binder: 14838:14841 transaction failed 29189/-3, size 24-8 line 3137
[  952.753152] binder: 14838:14841 Release 1 refcount change on invalid ref 1 ret -22
[  952.753159] binder: 14838:14841 unknown command -1073488791
01:49:20 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  952.753167] binder: 14838:14841 ioctl c0306201 20000380 returned -22
[  952.753303] binder: undelivered TRANSACTION_ERROR: 29189
[  952.880657] binder_alloc: 14855: binder_alloc_buf, no vma
[  952.880705] binder: 14855:14859 transaction failed 29189/-3, size 24-8 line 3137
[  952.880943] binder: BINDER_SET_CONTEXT_MGR already set
[  952.880953] binder: 14856:14860 ioctl 40046207 0 returned -16
[  952.881124] binder_alloc: 14855: binder_alloc_buf, no vma
[  952.881400] binder: 14855:14859 Release 1 refcount change on invalid ref 1 ret -22
01:49:20 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:20 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:20 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:20 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:20 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  952.881406] binder: 14855:14859 unknown command -1073488791
[  952.881414] binder: 14855:14859 ioctl c0306201 20000380 returned -22
[  952.881557] binder: undelivered TRANSACTION_ERROR: 29189
01:49:20 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  952.882402] binder: 14856:14860 transaction failed 29189/-3, size 24-8 line 3137
01:49:20 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:20 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:20 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  952.882901] binder: 14856:14860 ioctl c0306201 200002c0 returned -14
01:49:20 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:20 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:20 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  952.883027] binder: undelivered TRANSACTION_ERROR: 29189
[  953.023186] binder_alloc: 14873: binder_alloc_buf, no vma
01:49:20 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:20 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:20 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:20 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  953.023231] binder: 14873:14878 transaction failed 29189/-3, size 24-8 line 3137
01:49:20 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:20 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:20 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 2 printk messages dropped ** [  953.025746] binder_alloc: 14874: binder_alloc_buf, no vma
01:49:20 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:20 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:20 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 3 printk messages dropped ** [  953.038895] binder: 14874:14879 ioctl c0306201 20000380 returned -22
01:49:20 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:21 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 5 printk messages dropped ** [  953.164778] binder_alloc: 14896: binder_alloc_buf, no vma
[  953.164828] binder: 14896:14897 transaction failed 29189/-3, size 24-8 line 3137
01:49:21 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:21 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  953.165011] binder: 14896:14897 Release 1 refcount change on invalid ref 1 ret -22
01:49:21 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:21 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:21 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 1 printk messages dropped ** [  953.165026] binder: 14896:14897 ioctl c0306201 20000380 returned -22
** 5 printk messages dropped ** [  953.275084] binder: BINDER_SET_CONTEXT_MGR already set
01:49:21 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:21 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:21 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  953.275092] binder: 14910:14916 ioctl 40046207 0 returned -16
01:49:21 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:21 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:21 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 8 printk messages dropped ** [  953.396542] binder: 14927:14929 transaction failed 29189/-3, size 24-8 line 3137
01:49:21 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:21 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:21 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:21 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  953.396706] binder: 14927:14929 ioctl c0306201 200002c0 returned -14
** 2 printk messages dropped ** [  953.417344] binder: 14931:14932 transaction failed 29189/-3, size 24-8 line 3137
01:49:21 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:21 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:21 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:21 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 5 printk messages dropped ** [  953.502956] binder: 14949:14951 transaction failed 29189/-3, size 24-8 line 3137
01:49:21 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:21 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:21 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:21 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:21 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 9 printk messages dropped ** [  953.669525] binder: 14968:14969 transaction failed 29189/-3, size 24-8 line 3137
[  953.669838] binder: 14968:14969 Release 1 refcount change on invalid ref 1 ret -22
01:49:21 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:21 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:21 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:21 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:21 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 10 printk messages dropped ** [  953.817467] binder: 14988:14997 unknown command -1073488791
01:49:21 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:21 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:21 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  953.817475] binder: 14988:14997 ioctl c0306201 20000380 returned -22
01:49:21 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:21 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 2 printk messages dropped ** [  953.829170] binder: 14995:14998 transaction failed 29189/-3, size 24-8 line 3137
01:49:21 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:21 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 5 printk messages dropped ** [  953.940949] binder: 15010:15013 unknown command -1073488791
01:49:21 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:21 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:21 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:21 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  953.940957] binder: 15010:15013 ioctl c0306201 20000380 returned -22
01:49:21 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:21 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:21 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 8 printk messages dropped ** [  954.066804] binder: 15028:15031 unknown command -1073488791
01:49:21 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:21 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:21 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:21 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 5 printk messages dropped ** [  954.131043] binder: undelivered TRANSACTION_ERROR: 29189
01:49:22 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:22 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:22 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 3 printk messages dropped ** [  954.154177] binder: 15040:15045 unknown command -1073488791
01:49:22 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:22 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:22 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 6 printk messages dropped ** [  954.277058] binder_alloc: 15057: binder_alloc_buf, no vma
01:49:22 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:22 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:22 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:22 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 4 printk messages dropped ** [  954.279111] binder: undelivered TRANSACTION_ERROR: 29189
** 1 printk messages dropped ** [  954.364844] binder: 15069:15074 transaction failed 29189/-3, size 24-8 line 3137
01:49:22 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:22 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:22 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:22 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:22 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 5 printk messages dropped ** [  954.433692] binder: 15080:15082 transaction failed 29189/-3, size 24-8 line 3137
01:49:22 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:22 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:22 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 9 printk messages dropped ** [  954.588994] binder: 15100:15107 transaction failed 29189/-3, size 24-8 line 3137
01:49:22 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:22 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

[  954.589333] binder: 15100:15107 ioctl c0306201 200002c0 returned -14
01:49:22 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:22 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:22 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:22 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:22 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:22 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 2 printk messages dropped ** [  954.600782] binder: 15104:15109 transaction failed 29189/-3, size 24-8 line 3137
** 5 printk messages dropped ** [  954.719228] binder: 15120:15124 transaction failed 29189/-3, size 24-8 line 3137
01:49:22 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:22 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:22 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 3 printk messages dropped ** [  954.721467] binder: 15122:15126 transaction failed 29189/-3, size 24-8 line 3137
01:49:22 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:22 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:22 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 5 printk messages dropped ** [  954.850375] binder: 15140:15147 transaction failed 29189/-3, size 24-8 line 3137
** 3 printk messages dropped ** [  954.851480] binder: undelivered TRANSACTION_ERROR: 29189
01:49:22 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:22 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:22 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  954.855606] binder_alloc: 15143: binder_alloc_buf, no vma
[  954.855649] binder: 15143:15146 transaction failed 29189/-3, size 24-8 line 3137
01:49:22 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:22 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 3 printk messages dropped ** [  954.971737] binder: 15161:15162 transaction failed 29189/-3, size 24-8 line 3137
01:49:22 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:22 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:22 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 3 printk messages dropped ** [  954.979934] binder_alloc: 15161: binder_alloc_buf, no vma
01:49:22 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:22 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  954.979977] binder: 15159:15165 transaction failed 29189/-3, size 24-8 line 3137
[  954.980124] binder: 15159:15165 Release 1 refcount change on invalid ref 1 ret -22
01:49:22 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:22 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:22 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:22 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:22 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 3 printk messages dropped ** [  954.982376] binder: undelivered TRANSACTION_ERROR: 29189
** 1 printk messages dropped ** [  955.269662] binder: undelivered TRANSACTION_ERROR: 29189
01:49:23 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:23 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 1 printk messages dropped ** [  955.282520] binder: 15180:15181 transaction failed 29189/-3, size 24-8 line 3137
** 5 printk messages dropped ** [  955.408356] binder: undelivered TRANSACTION_ERROR: 29189
01:49:23 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:23 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:23 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:23 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  955.417698] binder_alloc: 15188: binder_alloc_buf, no vma
** 2 printk messages dropped ** [  955.426563] binder: 15188:15189 unknown command -1073488791
01:49:23 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:23 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  955.426571] binder: 15188:15189 ioctl c0306201 20000380 returned -22
01:49:23 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:23 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:23 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:23 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

** 8 printk messages dropped ** [  955.570859] binder: 15206:15208 transaction failed 29189/-3, size 24-8 line 3137
01:49:23 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:23 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  955.570985] binder: 15206:15208 ioctl c0306201 200002c0 returned -14
01:49:23 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:23 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:23 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 4 printk messages dropped ** [  955.668623] binder: 15218:15225 unknown command -1073488791
01:49:23 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:23 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:23 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 9 printk messages dropped ** [  955.786808] binder: undelivered TRANSACTION_ERROR: 29189
01:49:23 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:23 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:23 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:23 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:23 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 9 printk messages dropped ** [  955.888213] binder: undelivered TRANSACTION_ERROR: 29189
01:49:23 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:23 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:23 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:23 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:23 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:23 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  955.955462] binder_alloc: 15261: binder_alloc_buf, no vma
[  955.955506] binder: 15261:15265 transaction failed 29189/-3, size 24-8 line 3137
[  955.955651] binder: 15261:15265 Release 1 refcount change on invalid ref 1 ret -22
01:49:23 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:23 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 6 printk messages dropped ** [  956.041031] binder: undelivered TRANSACTION_ERROR: 29189
01:49:23 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:23 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  956.062020] binder_alloc: 15280: binder_alloc_buf, no vma
01:49:23 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:23 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:23 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 4 printk messages dropped ** [  956.062568] binder: undelivered TRANSACTION_ERROR: 29189
** 3 printk messages dropped ** [  956.162340] binder: undelivered TRANSACTION_ERROR: 29189
01:49:23 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:23 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:23 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

[  956.213276] binder_alloc: 15297: binder_alloc_buf, no vma
[  956.213322] binder: 15297:15302 transaction failed 29189/-3, size 24-8 line 3137
01:49:23 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:23 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:23 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 7 printk messages dropped ** [  956.276606] binder: undelivered TRANSACTION_ERROR: 29189
01:49:23 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:23 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  956.362902] binder_alloc: 15325: binder_alloc_buf, no vma
01:49:24 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:24 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

** 2 printk messages dropped ** [  956.365496] binder: 15321:15322 ioctl 40046207 0 returned -16
01:49:24 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:24 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:24 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:24 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 5 printk messages dropped ** [  956.369798] binder: 15321:15322 unknown command -1073488791
[  956.369806] binder: 15321:15322 ioctl c0306201 20000380 returned -22
01:49:24 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:24 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  956.370117] binder: undelivered TRANSACTION_ERROR: 29189
** 2 printk messages dropped ** [  956.459453] binder: 15336:15344 Release 1 refcount change on invalid ref 1 ret -22
01:49:24 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:24 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:24 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:24 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

** 5 printk messages dropped ** [  956.460436] binder: 15340:15342 ioctl c0306201 200002c0 returned -14
[  956.460583] binder: undelivered TRANSACTION_ERROR: 29189
[  956.585369] binder_alloc: 15358: binder_alloc_buf, no vma
[  956.585415] binder: 15358:15360 transaction failed 29189/-3, size 24-8 line 3137
01:49:24 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:24 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:24 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:24 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  956.585521] binder: 15358:15360 ioctl c0306201 200002c0 returned -14
** 4 printk messages dropped ** [  956.609138] binder: 15357:15361 unknown command -1073488791
01:49:24 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:24 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:24 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:24 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

01:49:24 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

[  956.609146] binder: 15357:15361 ioctl c0306201 20000380 returned -22
** 3 printk messages dropped ** [  956.677462] binder: 15369:15375 Release 1 refcount change on invalid ref 1 ret -22
01:49:24 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:24 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:24 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

01:49:24 executing program 3:
syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

** 5 printk messages dropped ** [  956.698009] binder: 15374:15377 ioctl c0306201 200002c0 returned -14
01:49:24 executing program 5:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
ioctl$ASHMEM_SET_NAME(0xffffffffffffffff, 0x41007701, &(0x7f0000000540)='/proc/self/net/pfkey\x00')
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x14, 0x0, &(0x7f0000000280)=[@increfs_done], 0xfffffe61, 0x0, 0x0})

01:49:24 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000480)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
open$dir(&(0x7f0000000c40)='./file0\x00', 0x0, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x1b, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
sched_setscheduler(0x0, 0x8, &(0x7f0000000080)=0x20)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000380)={0x75, 0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="066304400100000069dc03c07d161f78673130038c1f558ffb076d8bacb0fbf71515e85fddbffd80889e16d11e727bda00f3e81ff3967f598692382f4e8aed7e1e421c6a35f79ce9e6c25e9cd4b0cb28517134ce2c6f8dde1c76473bcc4a1955152aa063a7b2b88f3b3131fe1903e13a7133ba7d67"], 0x0, 0x0, 0x0})

01:49:24 executing program 1:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

01:49:24 executing program 4:
r0 = creat(&(0x7f0000000100)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, &(0x7f00000009c0)='threaded\x00', 0xd4b9afd)
unlink(&(0x7f0000000200)='./file0\x00')
creat(&(0x7f0000000040)='./file1\x00', 0x0)
clone(0x1000108, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = gettid()
mount$fuseblk(0x0, &(0x7f0000000140)='./file1\x00', 0x0, 0x80, 0x0)
ptrace$setopts(0x4206, r1, 0x0, 0x0)
ioctl$EVIOCGID(r0, 0x80084502, &(0x7f0000000080)=""/106)
tkill(r1, 0x1f)
ioctl$RTC_VL_CLR(r0, 0x7014)
ftruncate(r0, 0x0)

** 9 printk messages dropped ** [  956.810163] binder: 15390:15393 ioctl c0306201 200002c0 returned -14
01:49:24 executing program 0:
socket$netlink(0x10, 0x3, 0x10)
bind$netlink(0xffffffffffffffff, &(0x7f0000514ff4)={0x10, 0x0, 0xfffffffffffffffd, 0x2ffffffff}, 0xc)

[  956.810312] binder: undelivered TRANSACTION_ERROR: 29189
[  956.888662] binder_alloc: 15404: binder_alloc_buf, no vma
[  956.888709] binder: 15404:15407 transaction failed 29189/-3, size 24-8 line 3137
** 153 printk messages dropped ** [  958.933478] binder: undelivered TRANSACTION_ERROR: 29189
[  958.941355] binder_alloc: 15698: binder_alloc_buf, no vma
[  958.941402] binder: 15698:15701 transaction failed 29189/-3, size 24-8 line 3137
[  958.941495] binder: 15698:15701 ioctl c0306201 200002c0 returned -14
[  958.941643] binder: undelivered TRANSACTION_ERROR: 29189
[  959.077408] binder_alloc: 15713: binder_alloc_buf, no vma
[  959.077455] binder: 15713:15718 transaction failed 29189/-3, size 24-8 line 3137
[  959.077611] binder: 15713:15718 Release 1 refcount change on invalid ref 1 ret -22
[  959.077617] binder: 15713:15718 unknown command -1073488791
[  959.077635] binder: 15713:15718 ioctl c0306201 20000380 returned -22
[  959.077788] binder: undelivered TRANSACTION_ERROR: 29189
[  959.078482] binder_alloc: 15716: binder_alloc_buf, no vma
[  959.078531] binder: 15716:15720 transaction failed 29189/-3, size 24-8 line 3137
[  959.078648] binder: 15716:15720 ioctl c0306201 200002c0 returned -14
[  959.078834] binder: undelivered TRANSACTION_ERROR: 29189
[  959.167964] binder_alloc: 15731: binder_alloc_buf, no vma
[  959.168008] binder: 15731:15732 transaction failed 29189/-3, size 24-8 line 3137
[  959.168173] binder: 15731:15732 Release 1 refcount change on invalid ref 1 ret -22
[  959.168180] binder: 15731:15732 unknown command -1073488791
[  959.168188] binder: 15731:15732 ioctl c0306201 20000380 returned -22
[  959.168345] binder: undelivered TRANSACTION_ERROR: 29189
[  959.215444] binder_alloc: 15736: binder_alloc_buf, no vma
[  959.215490] binder: 15736:15740 transaction failed 29189/-3, size 24-8 line 3137
[  959.215596] binder: 15736:15740 ioctl c0306201 200002c0 returned -14
[  959.215782] binder: undelivered TRANSACTION_ERROR: 29189
[  959.276579] binder_alloc: 15747: binder_alloc_buf, no vma
[  959.276636] binder: 15747:15749 transaction failed 29189/-3, size 24-8 line 3137
[  959.276820] binder: 15747:15749 Release 1 refcount change on invalid ref 1 ret -22
[  959.276827] binder: 15747:15749 unknown command -1073488791
[  959.276835] binder: 15747:15749 ioctl c0306201 20000380 returned -22
[  959.277028] binder: undelivered TRANSACTION_ERROR: 29189
[  959.345506] binder_alloc: 15753: binder_alloc_buf, no vma
[  959.345543] binder: 15753:15761 transaction failed 29189/-3, size 24-8 line 3137
[  959.345638] binder: 15753:15761 ioctl c0306201 200002c0 returned -14
[  959.346125] binder: undelivered TRANSACTION_ERROR: 29189
[  959.426229] binder_alloc: 15760: binder_alloc_buf, no vma
[  959.426275] binder: 15760:15765 transaction failed 29189/-3, size 24-8 line 3137
[  959.427228] binder: 15760:15765 Release 1 refcount change on invalid ref 1 ret -22
[  959.427235] binder: 15760:15765 unknown command -1073488791
[  959.427243] binder: 15760:15765 ioctl c0306201 20000380 returned -22
[  959.427567] binder: undelivered TRANSACTION_ERROR: 29189
[  959.471911] binder_alloc: 15776: binder_alloc_buf, no vma
[  959.471959] binder: 15776:15779 transaction failed 29189/-3, size 24-8 line 3137
[  959.472973] binder: 15776:15779 ioctl c0306201 200002c0 returned -14
[  959.473113] binder: undelivered TRANSACTION_ERROR: 29189
[  959.532210] binder_alloc: 15783: binder_alloc_buf, no vma
[  959.532256] binder: 15783:15786 transaction failed 29189/-3, size 24-8 line 3137
[  959.532596] binder: 15783:15786 Release 1 refcount change on invalid ref 1 ret -22
[  959.532603] binder: 15783:15786 unknown command -1073488791
[  959.532611] binder: 15783:15786 ioctl c0306201 20000380 returned -22
[  959.534035] binder: undelivered TRANSACTION_ERROR: 29189
[  959.618227] binder_alloc: 15793: binder_alloc_buf, no vma
[  959.618272] binder: 15793:15797 transaction failed 29189/-3, size 24-8 line 3137
[  959.618366] binder: 15793:15797 ioctl c0306201 200002c0 returned -14
[  959.618499] binder: undelivered TRANSACTION_ERROR: 29189
[  959.642856] binder_alloc: 15798: binder_alloc_buf, no vma
[  959.642902] binder: 15798:15802 transaction failed 29189/-3, size 24-8 line 3137
[  959.643069] binder: 15798:15802 Release 1 refcount change on invalid ref 1 ret -22
[  959.643075] binder: 15798:15802 unknown command -1073488791
[  959.643084] binder: 15798:15802 ioctl c0306201 20000380 returned -22
[  959.643270] binder: undelivered TRANSACTION_ERROR: 29189
[  959.738241] binder_alloc: 15812: binder_alloc_buf, no vma
[  959.738287] binder: 15812:15818 transaction failed 29189/-3, size 24-8 line 3137
[  959.738475] binder: 15812:15818 Release 1 refcount change on invalid ref 1 ret -22
[  959.738482] binder: 15812:15818 unknown command -1073488791
[  959.738490] binder: 15812:15818 ioctl c0306201 20000380 returned -22
[  959.738669] binder: undelivered TRANSACTION_ERROR: 29189
[  959.748667] binder_alloc: 15813: binder_alloc_buf, no vma
[  959.748712] binder: 15813:15820 transaction failed 29189/-3, size 24-8 line 3137
[  959.748818] binder: 15813:15820 ioctl c0306201 200002c0 returned -14
[  959.748958] binder: undelivered TRANSACTION_ERROR: 29189
[  959.851202] binder_alloc: 15828: binder_alloc_buf, no vma
[  959.851248] binder: 15828:15834 transaction failed 29189/-3, size 24-8 line 3137
[  959.851408] binder: 15828:15834 Release 1 refcount change on invalid ref 1 ret -22
[  959.851420] binder: 15828:15834 unknown command -1073488791
[  959.851427] binder: 15828:15834 ioctl c0306201 20000380 returned -22
[  959.862147] binder: undelivered TRANSACTION_ERROR: 29189
[  959.893662] binder_alloc: 15835: binder_alloc_buf, no vma
[  959.893708] binder: 15835:15836 transaction failed 29189/-3, size 24-8 line 3137
[  959.893802] binder: 15835:15836 ioctl c0306201 200002c0 returned -14
[  959.893949] binder: undelivered TRANSACTION_ERROR: 29189
[  959.947334] binder_alloc: 15845: binder_alloc_buf, no vma
[  959.947379] binder: 15845:15848 transaction failed 29189/-3, size 24-8 line 3137
[  959.947563] binder: 15845:15848 Release 1 refcount change on invalid ref 1 ret -22
[  959.947570] binder: 15845:15848 unknown command -1073488791
[  959.947578] binder: 15845:15848 ioctl c0306201 20000380 returned -22
[  959.948116] binder: undelivered TRANSACTION_ERROR: 29189
[  960.004223] binder_alloc: 15852: binder_alloc_buf, no vma
[  960.004269] binder: 15852:15853 transaction failed 29189/-3, size 24-8 line 3137
[  960.004362] binder: 15852:15853 ioctl c0306201 200002c0 returned -14
[  960.004508] binder: undelivered TRANSACTION_ERROR: 29189
[  960.068844] binder_alloc: 15860: binder_alloc_buf, no vma
[  960.068890] binder: 15860:15864 transaction failed 29189/-3, size 24-8 line 3137
[  960.069551] binder: 15860:15864 Release 1 refcount change on invalid ref 1 ret -22
[  960.069557] binder: 15860:15864 unknown command -1073488791
[  960.069566] binder: 15860:15864 ioctl c0306201 20000380 returned -22
[  960.069684] binder: undelivered TRANSACTION_ERROR: 29189
[  960.117155] binder_alloc: 15868: binder_alloc_buf, no vma
[  960.117202] binder: 15868:15872 transaction failed 29189/-3, size 24-8 line 3137
[  960.117891] binder: 15868:15872 ioctl c0306201 200002c0 returned -14
[  960.118025] binder: undelivered TRANSACTION_ERROR: 29189
[  960.184675] binder_alloc: 15877: binder_alloc_buf, no vma
[  960.184722] binder: 15877:15883 transaction failed 29189/-3, size 24-8 line 3137
[  960.184895] binder: 15877:15883 Release 1 refcount change on invalid ref 1 ret -22
[  960.184902] binder: 15877:15883 unknown command -1073488791
[  960.184910] binder: 15877:15883 ioctl c0306201 20000380 returned -22
[  960.185454] binder: undelivered TRANSACTION_ERROR: 29189
[  960.273637] binder_alloc: 15888: binder_alloc_buf, no vma
[  960.273683] binder: 15888:15896 transaction failed 29189/-3, size 24-8 line 3137
[  960.273995] binder: 15888:15896 ioctl c0306201 200002c0 returned -14
[  960.274147] binder: undelivered TRANSACTION_ERROR: 29189
[  960.289268] binder_alloc: 15894: binder_alloc_buf, no vma
[  960.289314] binder: 15894:15897 transaction failed 29189/-3, size 24-8 line 3137
[  960.289481] binder: 15894:15897 Release 1 refcount change on invalid ref 1 ret -22
[  960.289487] binder: 15894:15897 unknown command -1073488791
[  960.289495] binder: 15894:15897 ioctl c0306201 20000380 returned -22
[  960.292880] binder: undelivered TRANSACTION_ERROR: 29189
[  960.397643] binder_alloc: 15911: binder_alloc_buf, no vma
[  960.397689] binder: 15911:15915 transaction failed 29189/-3, size 24-8 line 3137
[  960.397885] binder: 15911:15915 Release 1 refcount change on invalid ref 1 ret -22
[  960.397891] binder: 15911:15915 unknown command -1073488791
[  960.397899] binder: 15911:15915 ioctl c0306201 20000380 returned -22
[  960.398031] binder: undelivered TRANSACTION_ERROR: 29189
[  960.423012] binder_alloc: 15914: binder_alloc_buf, no vma
[  960.423057] binder: 15914:15918 transaction failed 29189/-3, size 24-8 line 3137
[  960.423153] binder: 15914:15918 ioctl c0306201 200002c0 returned -14
[  960.432323] binder: undelivered TRANSACTION_ERROR: 29189
[  960.480146] binder_alloc: 15925: binder_alloc_buf, no vma
[  960.480193] binder: 15925:15926 transaction failed 29189/-3, size 24-8 line 3137
[  960.480825] binder: 15925:15926 Release 1 refcount change on invalid ref 1 ret -22
[  960.480832] binder: 15925:15926 unknown command -1073488791
[  960.480840] binder: 15925:15926 ioctl c0306201 20000380 returned -22
[  960.509747] binder: undelivered TRANSACTION_ERROR: 29189
[  960.820264] binder_alloc: 15941: binder_alloc_buf, no vma
[  960.820310] binder: 15941:15945 transaction failed 29189/-3, size 24-8 line 3137
[  960.820454] binder: 15941:15945 Release 1 refcount change on invalid ref 1 ret -22
[  960.820461] binder: 15941:15945 unknown command -1073488791
[  960.820469] binder: 15941:15945 ioctl c0306201 20000380 returned -22
[  960.820622] binder: undelivered TRANSACTION_ERROR: 29189
[  960.831052] binder_alloc: 15937: binder_alloc_buf, no vma
[  960.831098] binder: 15937:15946 transaction failed 29189/-3, size 24-8 line 3137
[  960.847030] binder: 15937:15946 ioctl c0306201 200002c0 returned -14
[  960.847227] binder: undelivered TRANSACTION_ERROR: 29189
[  961.015070] binder_alloc: 15962: binder_alloc_buf, no vma
[  961.015116] binder: 15962:15966 transaction failed 29189/-3, size 24-8 line 3137
[  961.016056] binder: 15962:15966 Release 1 refcount change on invalid ref 1 ret -22
[  961.016063] binder: 15962:15966 unknown command -1073488791
[  961.016071] binder: 15962:15966 ioctl c0306201 20000380 returned -22
[  961.016239] binder: undelivered TRANSACTION_ERROR: 29189
[  961.029799] binder_alloc: 15963: binder_alloc_buf, no vma
[  961.029847] binder: 15963:15964 transaction failed 29189/-3, size 24-8 line 3137
[  961.029968] binder: 15963:15964 ioctl c0306201 200002c0 returned -14
[  961.030137] binder: undelivered TRANSACTION_ERROR: 29189
[  961.147720] binder_alloc: 15979: binder_alloc_buf, no vma
[  961.147764] binder: 15979:15982 transaction failed 29189/-3, size 24-8 line 3137
[  961.147950] binder: 15979:15982 Release 1 refcount change on invalid ref 1 ret -22
[  961.147957] binder: 15979:15982 unknown command -1073488791
[  961.147965] binder: 15979:15982 ioctl c0306201 20000380 returned -22
[  961.148115] binder: undelivered TRANSACTION_ERROR: 29189
[  961.172906] binder_alloc: 15981: binder_alloc_buf, no vma
[  961.172952] binder: 15981:15986 transaction failed 29189/-3, size 24-8 line 3137
[  961.173063] binder: 15981:15986 ioctl c0306201 200002c0 returned -14
[  961.176303] binder: undelivered TRANSACTION_ERROR: 29189
[  961.267462] binder_alloc: 15994: binder_alloc_buf, no vma
[  961.267507] binder: 15994:15995 transaction failed 29189/-3, size 24-8 line 3137
[  961.269037] binder: 15994:15995 ioctl c0306201 200002c0 returned -14
[  961.269177] binder: undelivered TRANSACTION_ERROR: 29189
[  961.272399] binder_alloc: 15997: binder_alloc_buf, no vma
[  961.272443] binder: 15997:16001 transaction failed 29189/-3, size 24-8 line 3137
[  961.272583] binder: 15997:16001 Release 1 refcount change on invalid ref 1 ret -22
[  961.272589] binder: 15997:16001 unknown command -1073488791
[  961.272597] binder: 15997:16001 ioctl c0306201 20000380 returned -22
[  961.272737] binder: undelivered TRANSACTION_ERROR: 29189
[  961.394847] binder_alloc: 16011: binder_alloc_buf, no vma
[  961.394892] binder: 16011:16019 transaction failed 29189/-3, size 24-8 line 3137
[  961.395351] binder: 16011:16019 ioctl c0306201 200002c0 returned -14
[  961.395509] binder: undelivered TRANSACTION_ERROR: 29189
[  961.421603] binder_alloc: 16015: binder_alloc_buf, no vma
[  961.421736] binder: 16015:16022 transaction failed 29189/-3, size 24-8 line 3137
[  961.421881] binder: 16015:16022 Release 1 refcount change on invalid ref 1 ret -22
[  961.421888] binder: 16015:16022 unknown command -1073488791
[  961.421896] binder: 16015:16022 ioctl c0306201 20000380 returned -22
[  961.422132] binder: undelivered TRANSACTION_ERROR: 29189
[  961.537723] binder_alloc: 16031: binder_alloc_buf, no vma
[  961.537769] binder: 16031:16035 transaction failed 29189/-3, size 24-8 line 3137
[  961.539995] binder: 16031:16035 ioctl c0306201 200002c0 returned -14
[  961.548318] binder: undelivered TRANSACTION_ERROR: 29189
[  961.564703] binder_alloc: 16037: binder_alloc_buf, no vma
[  961.564748] binder: 16037:16040 transaction failed 29189/-3, size 24-8 line 3137
[  961.564913] binder: 16037:16040 Release 1 refcount change on invalid ref 1 ret -22
[  961.564920] binder: 16037:16040 unknown command -1073488791
[  961.564928] binder: 16037:16040 ioctl c0306201 20000380 returned -22
[  961.565135] binder: undelivered TRANSACTION_ERROR: 29189
[  961.645633] binder_alloc: 16047: binder_alloc_buf, no vma
[  961.645678] binder: 16047:16052 transaction failed 29189/-3, size 24-8 line 3137
[  961.645773] binder: 16047:16052 ioctl c0306201 200002c0 returned -14
[  961.645923] binder: undelivered TRANSACTION_ERROR: 29189
[  961.710439] binder_alloc: 16058: binder_alloc_buf, no vma
[  961.710485] binder: 16058:16060 transaction failed 29189/-3, size 24-8 line 3137
[  961.711199] binder: 16058:16060 Release 1 refcount change on invalid ref 1 ret -22
[  961.711206] binder: 16058:16060 unknown command -1073488791
[  961.711215] binder: 16058:16060 ioctl c0306201 20000380 returned -22
[  961.711387] binder: undelivered TRANSACTION_ERROR: 29189
[  961.761016] binder_alloc: 16065: binder_alloc_buf, no vma
[  961.761063] binder: 16065:16071 transaction failed 29189/-3, size 24-8 line 3137
[  961.761815] binder: 16065:16071 ioctl c0306201 200002c0 returned -14
[  961.761946] binder: undelivered TRANSACTION_ERROR: 29189
[  961.794094] binder_alloc: 16074: binder_alloc_buf, no vma
[  961.794139] binder: 16074:16076 transaction failed 29189/-3, size 24-8 line 3137
[  961.794284] binder: 16074:16076 Release 1 refcount change on invalid ref 1 ret -22
[  961.794292] binder: 16074:16076 unknown command -1073488791
[  961.794300] binder: 16074:16076 ioctl c0306201 20000380 returned -22
[  961.794540] binder: undelivered TRANSACTION_ERROR: 29189
[  961.867434] binder_alloc: 16080: binder_alloc_buf, no vma
[  961.867482] binder: 16080:16084 transaction failed 29189/-3, size 24-8 line 3137
[  961.871383] binder: 16080:16084 Release 1 refcount change on invalid ref 1 ret -22
[  961.871390] binder: 16080:16084 unknown command -1073488791
[  961.871400] binder: 16080:16084 ioctl c0306201 20000380 returned -22
[  961.871563] binder: undelivered TRANSACTION_ERROR: 29189
[  961.885180] binder_alloc: 16082: binder_alloc_buf, no vma
[  961.885225] binder: 16082:16093 transaction failed 29189/-3, size 24-8 line 3137
[  961.885365] binder: 16082:16093 ioctl c0306201 200002c0 returned -14
[  961.886247] binder: undelivered TRANSACTION_ERROR: 29189
[  961.969035] binder_alloc: 16099: binder_alloc_buf, no vma
[  961.969082] binder: 16099:16102 transaction failed 29189/-3, size 24-8 line 3137
[  961.969238] binder: 16099:16102 Release 1 refcount change on invalid ref 1 ret -22
[  961.969244] binder: 16099:16102 unknown command -1073488791
[  961.969252] binder: 16099:16102 ioctl c0306201 20000380 returned -22
[  961.969607] binder: undelivered TRANSACTION_ERROR: 29189
[  962.000018] binder_alloc: 16101: binder_alloc_buf, no vma
[  962.000064] binder: 16101:16103 transaction failed 29189/-3, size 24-8 line 3137
[  962.000729] binder: 16101:16103 ioctl c0306201 200002c0 returned -14
[  962.001046] binder: undelivered TRANSACTION_ERROR: 29189
[  962.095167] binder_alloc: 16114: binder_alloc_buf, no vma
[  962.095215] binder: 16114:16118 transaction failed 29189/-3, size 24-8 line 3137
[  962.095333] binder: 16114:16118 ioctl c0306201 200002c0 returned -14
[  962.095487] binder: undelivered TRANSACTION_ERROR: 29189
[  962.109182] binder_alloc: 16115: binder_alloc_buf, no vma
[  962.109227] binder: 16115:16121 transaction failed 29189/-3, size 24-8 line 3137
[  962.109691] binder: 16115:16121 Release 1 refcount change on invalid ref 1 ret -22
[  962.109697] binder: 16115:16121 unknown command -1073488791
[  962.109706] binder: 16115:16121 ioctl c0306201 20000380 returned -22
[  962.111620] binder: undelivered TRANSACTION_ERROR: 29189
[  962.163934] binder_alloc: 16130: binder_alloc_buf, no vma
[  962.163981] binder: 16130:16131 transaction failed 29189/-3, size 24-8 line 3137
[  962.164186] binder: 16130:16131 ioctl c0306201 200002c0 returned -14
[  962.164481] binder: undelivered TRANSACTION_ERROR: 29189
[  962.236128] binder_alloc: 16138: binder_alloc_buf, no vma
[  962.236175] binder: 16138:16140 transaction failed 29189/-3, size 24-8 line 3137
[  962.237180] binder: 16138:16140 Release 1 refcount change on invalid ref 1 ret -22
[  962.237187] binder: 16138:16140 unknown command -1073488791
[  962.237196] binder: 16138:16140 ioctl c0306201 20000380 returned -22
[  962.237347] binder: undelivered TRANSACTION_ERROR: 29189
[  962.245765] binder_alloc: 16142: binder_alloc_buf, no vma
[  962.245810] binder: 16142:16145 transaction failed 29189/-3, size 24-8 line 3137
[  962.246352] binder: 16142:16145 ioctl c0306201 200002c0 returned -14
[  962.246532] binder: undelivered TRANSACTION_ERROR: 29189
[  962.374879] binder_alloc: 16155: binder_alloc_buf, no vma
[  962.374923] binder: 16155:16159 transaction failed 29189/-3, size 24-8 line 3137
[  962.375018] binder: 16155:16159 ioctl c0306201 200002c0 returned -14
[  962.375214] binder: undelivered TRANSACTION_ERROR: 29189
[  962.404862] binder_alloc: 16158: binder_alloc_buf, no vma
[  962.404908] binder: 16158:16161 transaction failed 29189/-3, size 24-8 line 3137
[  962.405079] binder: 16158:16161 Release 1 refcount change on invalid ref 1 ret -22
[  962.405085] binder: 16158:16161 unknown command -1073488791
[  962.405093] binder: 16158:16161 ioctl c0306201 20000380 returned -22
[  962.405264] binder: undelivered TRANSACTION_ERROR: 29189
[  962.502673] binder_alloc: 16178: binder_alloc_buf, no vma
[  962.502720] binder: 16178:16180 transaction failed 29189/-3, size 24-8 line 3137
[  962.508070] binder: 16178:16180 Release 1 refcount change on invalid ref 1 ret -22
[  962.508077] binder: 16178:16180 unknown command -1073488791
[  962.508085] binder: 16178:16180 ioctl c0306201 20000380 returned -22
[  962.508240] binder: undelivered TRANSACTION_ERROR: 29189
[  962.556024] binder_alloc: 16181: binder_alloc_buf, no vma
[  962.556069] binder: 16181:16182 transaction failed 29189/-3, size 24-8 line 3137
[  962.556176] binder: 16181:16182 ioctl c0306201 200002c0 returned -14
[  962.562406] binder: undelivered TRANSACTION_ERROR: 29189
[  962.651280] binder_alloc: 16198: binder_alloc_buf, no vma
[  962.651326] binder: 16198:16201 transaction failed 29189/-3, size 24-8 line 3137
[  962.651615] binder: 16198:16201 Release 1 refcount change on invalid ref 1 ret -22
[  962.651622] binder: 16198:16201 unknown command -1073488791
[  962.651629] binder: 16198:16201 ioctl c0306201 20000380 returned -22
[  962.651788] binder: undelivered TRANSACTION_ERROR: 29189
[  962.689930] binder_alloc: 16204: binder_alloc_buf, no vma
[  962.689975] binder: 16204:16208 transaction failed 29189/-3, size 24-8 line 3137
[  962.690081] binder: 16204:16208 ioctl c0306201 200002c0 returned -14
[  962.700152] binder: undelivered TRANSACTION_ERROR: 29189
[  962.809076] binder_alloc: 16224: binder_alloc_buf, no vma
[  962.809121] binder: 16224:16226 transaction failed 29189/-3, size 24-8 line 3137
[  962.809210] binder: 16224:16226 ioctl c0306201 200002c0 returned -14
[  962.809501] binder: undelivered TRANSACTION_ERROR: 29189
[  962.873901] binder_alloc: 16218: binder_alloc_buf, no vma
[  962.873947] binder: 16218:16229 transaction failed 29189/-3, size 24-8 line 3137
[  962.874095] binder: 16218:16229 Release 1 refcount change on invalid ref 1 ret -22
[  962.874101] binder: 16218:16229 unknown command -1073488791
[  962.874109] binder: 16218:16229 ioctl c0306201 20000380 returned -22
[  962.874273] binder: undelivered TRANSACTION_ERROR: 29189
[  962.883168] binder_alloc: 16230: binder_alloc_buf, no vma
[  962.883254] binder: 16230:16235 transaction failed 29189/-3, size 24-8 line 3137
[  962.884337] binder: 16230:16235 ioctl c0306201 200002c0 returned -14
[  962.884509] binder: undelivered TRANSACTION_ERROR: 29189
[  962.993995] binder_alloc: 16245: binder_alloc_buf, no vma
[  962.994041] binder: 16245:16248 transaction failed 29189/-3, size 24-8 line 3137
[  962.994678] binder: 16245:16248 Release 1 refcount change on invalid ref 1 ret -22
[  962.994685] binder: 16245:16248 unknown command -1073488791
[  962.994693] binder: 16245:16248 ioctl c0306201 20000380 returned -22
[  962.994856] binder: undelivered TRANSACTION_ERROR: 29189
[  963.002039] binder_alloc: 16250: binder_alloc_buf, no vma
[  963.002081] binder: 16250:16251 transaction failed 29189/-3, size 24-8 line 3137
[  963.002195] binder: 16250:16251 ioctl c0306201 200002c0 returned -14
[  963.002337] binder: undelivered TRANSACTION_ERROR: 29189
[  963.098800] binder_alloc: 16264: binder_alloc_buf, no vma
[  963.098845] binder: 16264:16267 transaction failed 29189/-3, size 24-8 line 3137
[  963.099787] binder: 16264:16267 Release 1 refcount change on invalid ref 1 ret -22
[  963.099793] binder: 16264:16267 unknown command -1073488791
[  963.099802] binder: 16264:16267 ioctl c0306201 20000380 returned -22
[  963.099947] binder: undelivered TRANSACTION_ERROR: 29189
[  963.135137] binder_alloc: 16263: binder_alloc_buf, no vma
[  963.136356] binder: 16263:16272 transaction failed 29189/-3, size 24-8 line 3137
[  963.137311] binder: 16263:16272 ioctl c0306201 200002c0 returned -14
[  963.137574] binder: undelivered TRANSACTION_ERROR: 29189
[  963.200530] binder_alloc: 16280: binder_alloc_buf, no vma
[  963.200576] binder: 16280:16284 transaction failed 29189/-3, size 24-8 line 3137
[  963.200690] binder: 16280:16284 ioctl c0306201 200002c0 returned -14
[  963.200823] binder: undelivered TRANSACTION_ERROR: 29189
[  963.204676] binder_alloc: 16282: binder_alloc_buf, no vma
[  963.204721] binder: 16282:16285 transaction failed 29189/-3, size 24-8 line 3137
[  963.207780] binder: 16282:16285 Release 1 refcount change on invalid ref 1 ret -22
[  963.207787] binder: 16282:16285 unknown command -1073488791
[  963.207795] binder: 16282:16285 ioctl c0306201 20000380 returned -22
[  963.207916] binder: undelivered TRANSACTION_ERROR: 29189
[  963.306286] binder_alloc: 16296: binder_alloc_buf, no vma
[  963.306328] binder: 16296:16298 transaction failed 29189/-3, size 24-8 line 3137
[  963.308000] binder: 16296:16298 Release 1 refcount change on invalid ref 1 ret -22
[  963.308007] binder: 16296:16298 unknown command -1073488791
[  963.308015] binder: 16296:16298 ioctl c0306201 20000380 returned -22
[  963.308276] binder: undelivered TRANSACTION_ERROR: 29189
[  963.309642] binder_alloc: 16295: binder_alloc_buf, no vma
[  963.309685] binder: 16295:16299 transaction failed 29189/-3, size 24-8 line 3137
[  963.310725] binder: 16295:16299 ioctl c0306201 200002c0 returned -14
[  963.310852] binder: undelivered TRANSACTION_ERROR: 29189
[  963.404147] binder_alloc: 16310: binder_alloc_buf, no vma
[  963.404193] binder: 16310:16314 transaction failed 29189/-3, size 24-8 line 3137
[  963.404646] binder: 16310:16314 ioctl c0306201 200002c0 returned -14
[  963.404803] binder: undelivered TRANSACTION_ERROR: 29189
[  963.421322] binder_alloc: 16313: binder_alloc_buf, no vma
[  963.421368] binder: 16313:16318 transaction failed 29189/-3, size 24-8 line 3137
[  963.421611] binder: 16313:16318 Release 1 refcount change on invalid ref 1 ret -22
[  963.421617] binder: 16313:16318 unknown command -1073488791
[  963.421634] binder: 16313:16318 ioctl c0306201 20000380 returned -22
[  963.421801] binder: undelivered TRANSACTION_ERROR: 29189
[  963.518278] binder_alloc: 16329: binder_alloc_buf, no vma
[  963.518530] binder: 16329:16330 transaction failed 29189/-3, size 24-8 line 3137
[  963.518653] binder: 16329:16330 ioctl c0306201 200002c0 returned -14
[  963.518783] binder: undelivered TRANSACTION_ERROR: 29189
[  963.527438] binder_alloc: 16331: binder_alloc_buf, no vma
[  963.527485] binder: 16331:16333 transaction failed 29189/-3, size 24-8 line 3137
[  963.554037] binder: 16331:16333 Release 1 refcount change on invalid ref 1 ret -22
[  963.554045] binder: 16331:16333 unknown command -1073488791
[  963.554055] binder: 16331:16333 ioctl c0306201 20000380 returned -22
[  963.554483] binder: undelivered TRANSACTION_ERROR: 29189
[  963.650271] binder_alloc: 16347: binder_alloc_buf, no vma
[  963.650318] binder: 16347:16354 transaction failed 29189/-3, size 24-8 line 3137
[  963.650791] binder: 16347:16354 ioctl c0306201 200002c0 returned -14
[  963.650945] binder: undelivered TRANSACTION_ERROR: 29189
[  963.688917] binder_alloc: 16352: binder_alloc_buf, no vma
[  963.688962] binder: 16352:16358 transaction failed 29189/-3, size 24-8 line 3137
[  963.691766] binder: 16352:16358 Release 1 refcount change on invalid ref 1 ret -22
[  963.691773] binder: 16352:16358 unknown command -1073488791
[  963.691782] binder: 16352:16358 ioctl c0306201 20000380 returned -22
[  963.691946] binder: undelivered TRANSACTION_ERROR: 29189
[  963.801855] binder_alloc: 16375: binder_alloc_buf, no vma
[  963.801901] binder: 16375:16376 transaction failed 29189/-3, size 24-8 line 3137
[  963.802045] binder: 16375:16376 Release 1 refcount change on invalid ref 1 ret -22
[  963.802052] binder: 16375:16376 unknown command -1073488791
[  963.802060] binder: 16375:16376 ioctl c0306201 20000380 returned -22
[  963.802174] binder: undelivered TRANSACTION_ERROR: 29189
[  963.805519] binder_alloc: 16367: binder_alloc_buf, no vma
[  963.805563] binder: 16367:16373 transaction failed 29189/-3, size 24-8 line 3137
[  963.805663] binder: 16367:16373 ioctl c0306201 200002c0 returned -14
[  963.805802] binder: undelivered TRANSACTION_ERROR: 29189
[  963.908234] binder_alloc: 16383: binder_alloc_buf, no vma
[  963.908282] binder: 16383:16388 transaction failed 29189/-3, size 24-8 line 3137
[  963.908392] binder: 16383:16388 ioctl c0306201 200002c0 returned -14
[  963.908699] binder: undelivered TRANSACTION_ERROR: 29189
[  963.923633] binder_alloc: 16386: binder_alloc_buf, no vma
[  963.923679] binder: 16386:16390 transaction failed 29189/-3, size 24-8 line 3137
[  963.925557] binder: 16386:16390 Release 1 refcount change on invalid ref 1 ret -22
[  963.925565] binder: 16386:16390 unknown command -1073488791
[  963.925575] binder: 16386:16390 ioctl c0306201 20000380 returned -22
[  963.925719] binder: undelivered TRANSACTION_ERROR: 29189
[  964.007358] binder_alloc: 16396: binder_alloc_buf, no vma
[  964.007403] binder: 16396:16399 transaction failed 29189/-3, size 24-8 line 3137
[  964.007504] binder: 16396:16399 ioctl c0306201 200002c0 returned -14
[  964.007648] binder: undelivered TRANSACTION_ERROR: 29189
[  964.079449] binder_alloc: 16410: binder_alloc_buf, no vma
[  964.079494] binder: 16410:16412 transaction failed 29189/-3, size 24-8 line 3137
[  964.080164] binder: 16410:16412 Release 1 refcount change on invalid ref 1 ret -22
[  964.080171] binder: 16410:16412 unknown command -1073488791
[  964.080179] binder: 16410:16412 ioctl c0306201 20000380 returned -22
[  964.080323] binder: undelivered TRANSACTION_ERROR: 29189
[  964.120637] binder_alloc: 16411: binder_alloc_buf, no vma
[  964.120682] binder: 16411:16415 transaction failed 29189/-3, size 24-8 line 3137
[  964.121210] binder: 16411:16415 ioctl c0306201 200002c0 returned -14
[  964.121369] binder: undelivered TRANSACTION_ERROR: 29189
[  964.229528] binder_alloc: 16430: binder_alloc_buf, no vma
[  964.229572] binder: 16430:16431 transaction failed 29189/-3, size 24-8 line 3137
[  964.229667] binder: 16430:16431 ioctl c0306201 200002c0 returned -14
[  964.229815] binder: undelivered TRANSACTION_ERROR: 29189
[  964.253447] binder_alloc: 16427: binder_alloc_buf, no vma
[  964.253493] binder: 16427:16435 transaction failed 29189/-3, size 24-8 line 3137
[  964.253682] binder: 16427:16435 Release 1 refcount change on invalid ref 1 ret -22
[  964.253689] binder: 16427:16435 unknown command -1073488791
[  964.253697] binder: 16427:16435 ioctl c0306201 20000380 returned -22
[  964.254534] binder: undelivered TRANSACTION_ERROR: 29189
[  964.357905] binder_alloc: 16448: binder_alloc_buf, no vma
[  964.357951] binder: 16448:16449 transaction failed 29189/-3, size 24-8 line 3137
[  964.358121] binder: 16448:16449 ioctl c0306201 200002c0 returned -14
[  964.358258] binder: undelivered TRANSACTION_ERROR: 29189
[  964.370957] binder_alloc: 16450: binder_alloc_buf, no vma
[  964.371003] binder: 16450:16455 transaction failed 29189/-3, size 24-8 line 3137
[  964.371616] binder: 16450:16455 Release 1 refcount change on invalid ref 1 ret -22
[  964.371631] binder: 16450:16455 unknown command -1073488791
[  964.371639] binder: 16450:16455 ioctl c0306201 20000380 returned -22
[  964.371754] binder: undelivered TRANSACTION_ERROR: 29189
[  964.567384] binder_alloc: 16475: binder_alloc_buf, no vma
[  964.567429] binder: 16475:16483 transaction failed 29189/-3, size 24-8 line 3137
[  964.567614] binder: 16475:16483 Release 1 refcount change on invalid ref 1 ret -22
[  964.567621] binder: 16475:16483 unknown command -1073488791
[  964.567628] binder: 16475:16483 ioctl c0306201 20000380 returned -22
[  964.567791] binder: undelivered TRANSACTION_ERROR: 29189
[  964.631093] binder_alloc: 16486: binder_alloc_buf, no vma
[  964.631147] binder: 16486:16493 transaction failed 29189/-3, size 24-8 line 3137
[  964.631236] binder: 16486:16493 ioctl c0306201 200002c0 returned -14
[  964.631388] binder: undelivered TRANSACTION_ERROR: 29189
[  964.714921] binder_alloc: 16498: binder_alloc_buf, no vma
[  964.714969] binder: 16498:16502 transaction failed 29189/-3, size 24-8 line 3137
[  964.715154] binder: 16498:16502 Release 1 refcount change on invalid ref 1 ret -22
[  964.715160] binder: 16498:16502 unknown command -1073488791
[  964.715169] binder: 16498:16502 ioctl c0306201 20000380 returned -22
[  964.715558] binder: undelivered TRANSACTION_ERROR: 29189
[  964.761246] binder_alloc: 16511: binder_alloc_buf, no vma
[  964.761306] binder: 16511:16514 transaction failed 29189/-3, size 24-8 line 3137
[  964.761410] binder: 16511:16514 ioctl c0306201 200002c0 returned -14
[  964.761560] binder: undelivered TRANSACTION_ERROR: 29189
[  964.833951] binder_alloc: 16523: binder_alloc_buf, no vma
[  964.833997] binder: 16523:16525 transaction failed 29189/-3, size 24-8 line 3137
[  964.834257] binder: 16523:16525 Release 1 refcount change on invalid ref 1 ret -22
[  964.834263] binder: 16523:16525 unknown command -1073488791
[  964.834272] binder: 16523:16525 ioctl c0306201 20000380 returned -22
[  964.834405] binder: undelivered TRANSACTION_ERROR: 29189
[  964.837772] binder_alloc: 16524: binder_alloc_buf, no vma
[  964.837816] binder: 16524:16526 transaction failed 29189/-3, size 24-8 line 3137
[  964.837954] binder: 16524:16526 ioctl c0306201 200002c0 returned -14
[  964.838094] binder: undelivered TRANSACTION_ERROR: 29189
[  964.954223] binder_alloc: 16539: binder_alloc_buf, no vma
[  964.954270] binder: 16539:16543 transaction failed 29189/-3, size 24-8 line 3137
[  964.958036] binder: 16539:16543 ioctl c0306201 200002c0 returned -14
[  964.958212] binder: undelivered TRANSACTION_ERROR: 29189
[  964.983653] binder_alloc: 16546: binder_alloc_buf, no vma
[  964.983700] binder: 16546:16547 transaction failed 29189/-3, size 24-8 line 3137
[  964.985136] binder: 16546:16547 Release 1 refcount change on invalid ref 1 ret -22
[  964.985143] binder: 16546:16547 unknown command -1073488791
[  964.985150] binder: 16546:16547 ioctl c0306201 20000380 returned -22
[  964.985352] binder: undelivered TRANSACTION_ERROR: 29189
[  965.108794] binder_alloc: 16560: binder_alloc_buf, no vma
[  965.108841] binder: 16560:16563 transaction failed 29189/-3, size 24-8 line 3137
[  965.109571] binder: 16560:16563 ioctl c0306201 200002c0 returned -14
[  965.112285] binder: undelivered TRANSACTION_ERROR: 29189
[  965.121523] binder_alloc: 16564: binder_alloc_buf, no vma
[  965.121568] binder: 16564:16569 transaction failed 29189/-3, size 24-8 line 3137
[  965.122546] binder: 16564:16569 Release 1 refcount change on invalid ref 1 ret -22
[  965.122552] binder: 16564:16569 unknown command -1073488791
[  965.122560] binder: 16564:16569 ioctl c0306201 20000380 returned -22
[  965.122712] binder: undelivered TRANSACTION_ERROR: 29189
[  965.264512] binder_alloc: 16586: binder_alloc_buf, no vma
[  965.264559] binder: 16586:16589 transaction failed 29189/-3, size 24-8 line 3137
[  965.264726] binder: 16586:16589 Release 1 refcount change on invalid ref 1 ret -22
[  965.264733] binder: 16586:16589 unknown command -1073488791
[  965.264741] binder: 16586:16589 ioctl c0306201 20000380 returned -22
[  965.264900] binder: undelivered TRANSACTION_ERROR: 29189
[  965.293644] binder_alloc: 16585: binder_alloc_buf, no vma
[  965.293689] binder: 16585:16591 transaction failed 29189/-3, size 24-8 line 3137
[  965.309205] binder: 16585:16591 ioctl c0306201 200002c0 returned -14
[  965.309375] binder: undelivered TRANSACTION_ERROR: 29189
[  965.435505] binder_alloc: 16604: binder_alloc_buf, no vma
[  965.435551] binder: 16604:16608 transaction failed 29189/-3, size 24-8 line 3137
[  965.437345] binder: 16604:16608 Release 1 refcount change on invalid ref 1 ret -22
[  965.437352] binder: 16604:16608 unknown command -1073488791
[  965.437360] binder: 16604:16608 ioctl c0306201 20000380 returned -22
[  965.437506] binder: undelivered TRANSACTION_ERROR: 29189
[  965.453096] binder_alloc: 16607: binder_alloc_buf, no vma
[  965.453140] binder: 16607:16614 transaction failed 29189/-3, size 24-8 line 3137
[  965.453862] binder: 16607:16614 ioctl c0306201 200002c0 returned -14
[  965.454000] binder: undelivered TRANSACTION_ERROR: 29189
[  965.538966] binder_alloc: 16622: binder_alloc_buf, no vma
[  965.539013] binder: 16622:16625 transaction failed 29189/-3, size 24-8 line 3137
[  965.547346] binder: 16622:16625 ioctl c0306201 200002c0 returned -14
[  965.547621] binder: undelivered TRANSACTION_ERROR: 29189
[  965.582226] binder_alloc: 16627: binder_alloc_buf, no vma
[  965.582274] binder: 16627:16633 transaction failed 29189/-3, size 24-8 line 3137
[  965.582497] binder: 16627:16633 Release 1 refcount change on invalid ref 1 ret -22
[  965.582502] binder: 16627:16633 unknown command -1073488791
[  965.582510] binder: 16627:16633 ioctl c0306201 20000380 returned -22
[  965.582668] binder: undelivered TRANSACTION_ERROR: 29189
[  965.699752] binder_alloc: 16641: binder_alloc_buf, no vma
[  965.699797] binder: 16641:16646 transaction failed 29189/-3, size 24-8 line 3137
[  965.699931] binder: 16641:16646 Release 1 refcount change on invalid ref 1 ret -22
[  965.699936] binder: 16641:16646 unknown command -1073488791
[  965.699943] binder: 16641:16646 ioctl c0306201 20000380 returned -22
[  965.700255] binder: undelivered TRANSACTION_ERROR: 29189
[  965.734773] binder_alloc: 16647: binder_alloc_buf, no vma
[  965.734819] binder: 16647:16651 transaction failed 29189/-3, size 24-8 line 3137
[  965.734916] binder: 16647:16651 ioctl c0306201 200002c0 returned -14
[  965.735064] binder: undelivered TRANSACTION_ERROR: 29189
[  965.803644] binder_alloc: 16659: binder_alloc_buf, no vma
[  965.803690] binder: 16659:16663 transaction failed 29189/-3, size 24-8 line 3137
[  965.803836] binder: 16659:16663 Release 1 refcount change on invalid ref 1 ret -22
[  965.803843] binder: 16659:16663 unknown command -1073488791
[  965.803851] binder: 16659:16663 ioctl c0306201 20000380 returned -22
[  965.804007] binder: undelivered TRANSACTION_ERROR: 29189
[  965.909423] binder_alloc: 16677: binder_alloc_buf, no vma
[  965.909470] binder: 16677:16680 transaction failed 29189/-3, size 24-8 line 3137
[  965.910389] binder: 16677:16680 Release 1 refcount change on invalid ref 1 ret -22
[  965.910395] binder: 16677:16680 unknown command -1073488791
[  965.910404] binder: 16677:16680 ioctl c0306201 20000380 returned -22
[  966.104406] binder: undelivered TRANSACTION_ERROR: 29189
[  966.118792] binder_alloc: 16668: binder_alloc_buf, no vma
[  966.118841] binder: 16668:16672 transaction failed 29189/-3, size 24-8 line 3137
[  966.118941] binder: 16668:16672 ioctl c0306201 200002c0 returned -14
[  966.119203] binder: undelivered TRANSACTION_ERROR: 29189
[  966.415472] binder_alloc: 16693: binder_alloc_buf, no vma
[  966.415521] binder: 16693:16694 transaction failed 29189/-3, size 24-8 line 3137
[  966.415648] binder: 16693:16694 ioctl c0306201 200002c0 returned -14
[  966.415965] binder: undelivered TRANSACTION_ERROR: 29189
[  966.442358] binder_alloc: 16698: binder_alloc_buf, no vma
[  966.442402] binder: 16698:16703 transaction failed 29189/-3, size 24-8 line 3137
[  966.442572] binder: 16698:16703 Release 1 refcount change on invalid ref 1 ret -22
[  966.442579] binder: 16698:16703 unknown command -1073488791
[  966.442588] binder: 16698:16703 ioctl c0306201 20000380 returned -22
[  966.442738] binder: undelivered TRANSACTION_ERROR: 29189
[  966.552624] binder_alloc: 16709: binder_alloc_buf, no vma
[  966.552668] binder: 16709:16719 transaction failed 29189/-3, size 24-8 line 3137
[  966.552775] binder: 16709:16719 ioctl c0306201 200002c0 returned -14
[  966.552926] binder: undelivered TRANSACTION_ERROR: 29189
[  966.556927] binder_alloc: 16711: binder_alloc_buf, no vma
[  966.556971] binder: 16711:16718 transaction failed 29189/-3, size 24-8 line 3137
[  966.557229] binder: 16711:16718 Release 1 refcount change on invalid ref 1 ret -22
[  966.557236] binder: 16711:16718 unknown command -1073488791
[  966.557244] binder: 16711:16718 ioctl c0306201 20000380 returned -22
[  966.561163] binder: undelivered TRANSACTION_ERROR: 29189
[  966.650930] binder_alloc: 16729: binder_alloc_buf, no vma
[  966.650977] binder: 16729:16735 transaction failed 29189/-3, size 24-8 line 3137
[  966.651070] binder: 16729:16735 ioctl c0306201 200002c0 returned -14
[  966.651201] binder: undelivered TRANSACTION_ERROR: 29189
[  966.658421] binder_alloc: 16740: binder_alloc_buf, no vma
[  966.658469] binder: 16740:16741 transaction failed 29189/-3, size 24-8 line 3137
[  966.658705] binder: 16740:16741 Release 1 refcount change on invalid ref 1 ret -22
[  966.658712] binder: 16740:16741 unknown command -1073488791
[  966.658720] binder: 16740:16741 ioctl c0306201 20000380 returned -22
[  966.659021] binder: undelivered TRANSACTION_ERROR: 29189
[  966.760889] binder_alloc: 16746: binder_alloc_buf, no vma
[  966.760934] binder: 16746:16750 transaction failed 29189/-3, size 24-8 line 3137
[  966.761541] binder: 16746:16750 ioctl c0306201 200002c0 returned -14
[  966.761684] binder: undelivered TRANSACTION_ERROR: 29189
[  966.803920] binder_alloc: 16752: binder_alloc_buf, no vma
[  966.803967] binder: 16752:16756 transaction failed 29189/-3, size 24-8 line 3137
[  966.804157] binder: 16752:16756 Release 1 refcount change on invalid ref 1 ret -22
[  966.804163] binder: 16752:16756 unknown command -1073488791
[  966.804172] binder: 16752:16756 ioctl c0306201 20000380 returned -22
[  966.804323] binder: undelivered TRANSACTION_ERROR: 29189
[  966.911761] binder_alloc: 16774: binder_alloc_buf, no vma
[  966.911808] binder: 16774:16776 transaction failed 29189/-3, size 24-8 line 3137
[  966.912504] binder: 16774:16776 Release 1 refcount change on invalid ref 1 ret -22
[  966.912511] binder: 16774:16776 unknown command -1073488791
[  966.912519] binder: 16774:16776 ioctl c0306201 20000380 returned -22
[  966.912831] binder: undelivered TRANSACTION_ERROR: 29189
[  966.935610] binder_alloc: 16769: binder_alloc_buf, no vma
[  966.935655] binder: 16769:16772 transaction failed 29189/-3, size 24-8 line 3137
[  966.935752] binder: 16769:16772 ioctl c0306201 200002c0 returned -14
[  966.936048] binder: undelivered TRANSACTION_ERROR: 29189
[  967.023228] binder_alloc: 16788: binder_alloc_buf, no vma
[  967.023274] binder: 16788:16792 transaction failed 29189/-3, size 24-8 line 3137
[  967.024191] binder: 16788:16792 Release 1 refcount change on invalid ref 1 ret -22
[  967.024197] binder: 16788:16792 unknown command -1073488791
[  967.024206] binder: 16788:16792 ioctl c0306201 20000380 returned -22
[  967.024352] binder: undelivered TRANSACTION_ERROR: 29189
[  967.039016] binder_alloc: 16791: binder_alloc_buf, no vma
[  967.039061] binder: 16791:16794 transaction failed 29189/-3, size 24-8 line 3137
[  967.039172] binder: 16791:16794 ioctl c0306201 200002c0 returned -14
[  967.039320] binder: undelivered TRANSACTION_ERROR: 29189
[  967.114220] binder_alloc: 16804: binder_alloc_buf, no vma
[  967.114266] binder: 16804:16806 transaction failed 29189/-3, size 24-8 line 3137
[  967.114741] binder: 16804:16806 Release 1 refcount change on invalid ref 1 ret -22
[  967.114747] binder: 16804:16806 unknown command -1073488791
[  967.114756] binder: 16804:16806 ioctl c0306201 20000380 returned -22
[  967.114928] binder: undelivered TRANSACTION_ERROR: 29189
[  967.213713] binder_alloc: 16813: binder_alloc_buf, no vma
[  967.213759] binder: 16813:16817 transaction failed 29189/-3, size 24-8 line 3137
[  967.213852] binder: 16813:16817 ioctl c0306201 200002c0 returned -14
[  967.214009] binder: undelivered TRANSACTION_ERROR: 29189
[  967.243157] binder_alloc: 16818: binder_alloc_buf, no vma
[  967.243204] binder: 16818:16823 transaction failed 29189/-3, size 24-8 line 3137
[  967.243473] binder: 16818:16823 Release 1 refcount change on invalid ref 1 ret -22
[  967.243479] binder: 16818:16823 unknown command -1073488791
[  967.243488] binder: 16818:16823 ioctl c0306201 20000380 returned -22
[  967.247224] binder: undelivered TRANSACTION_ERROR: 29189
[  967.350506] binder_alloc: 16830: binder_alloc_buf, no vma
[  967.350550] binder: 16830:16837 transaction failed 29189/-3, size 24-8 line 3137
[  967.350733] binder: 16830:16837 Release 1 refcount change on invalid ref 1 ret -22
[  967.350740] binder: 16830:16837 unknown command -1073488791
[  967.350748] binder: 16830:16837 ioctl c0306201 20000380 returned -22
[  967.350910] binder: undelivered TRANSACTION_ERROR: 29189
[  967.384486] binder_alloc: 16832: binder_alloc_buf, no vma
[  967.384537] binder: 16832:16840 transaction failed 29189/-3, size 24-8 line 3137
[  967.384949] binder: 16832:16840 ioctl c0306201 200002c0 returned -14
[  967.385314] binder: undelivered TRANSACTION_ERROR: 29189
[  967.439543] binder_alloc: 16848: binder_alloc_buf, no vma
[  967.439589] binder: 16848:16851 transaction failed 29189/-3, size 24-8 line 3137
[  967.439768] binder: 16848:16851 Release 1 refcount change on invalid ref 1 ret -22
[  967.439775] binder: 16848:16851 unknown command -1073488791
[  967.439782] binder: 16848:16851 ioctl c0306201 20000380 returned -22
[  967.439956] binder: undelivered TRANSACTION_ERROR: 29189
[  967.517801] binder_alloc: 16860: binder_alloc_buf, no vma
[  967.517847] binder: 16860:16862 transaction failed 29189/-3, size 24-8 line 3137
[  967.517949] binder: 16860:16862 ioctl c0306201 200002c0 returned -14
[  967.518098] binder: undelivered TRANSACTION_ERROR: 29189
[  967.571058] binder_alloc: 16868: binder_alloc_buf, no vma
[  967.571105] binder: 16868:16869 transaction failed 29189/-3, size 24-8 line 3137
[  967.571375] binder: 16868:16869 Release 1 refcount change on invalid ref 1 ret -22
[  967.571381] binder: 16868:16869 unknown command -1073488791
[  967.571390] binder: 16868:16869 ioctl c0306201 20000380 returned -22
[  967.571599] binder: undelivered TRANSACTION_ERROR: 29189
[  967.629164] binder_alloc: 16873: binder_alloc_buf, no vma
[  967.629209] binder: 16873:16876 transaction failed 29189/-3, size 24-8 line 3137
[  967.630128] binder: 16873:16876 ioctl c0306201 200002c0 returned -14
[  967.630284] binder: undelivered TRANSACTION_ERROR: 29189
[  967.681296] binder_alloc: 16883: binder_alloc_buf, no vma
[  967.681342] binder: 16883:16885 transaction failed 29189/-3, size 24-8 line 3137
[  967.681954] binder: 16883:16885 Release 1 refcount change on invalid ref 1 ret -22
[  967.681960] binder: 16883:16885 unknown command -1073488791
[  967.681969] binder: 16883:16885 ioctl c0306201 20000380 returned -22
[  967.682210] binder: undelivered TRANSACTION_ERROR: 29189
[  967.743289] binder_alloc: 16891: binder_alloc_buf, no vma
[  967.743336] binder: 16891:16894 transaction failed 29189/-3, size 24-8 line 3137
[  967.743429] binder: 16891:16894 ioctl c0306201 200002c0 returned -14
[  967.743577] binder: undelivered TRANSACTION_ERROR: 29189
[  967.784770] binder_alloc: 16893: binder_alloc_buf, no vma
[  967.784815] binder: 16893:16898 transaction failed 29189/-3, size 24-8 line 3137
[  967.784966] binder: 16893:16898 Release 1 refcount change on invalid ref 1 ret -22
[  967.784972] binder: 16893:16898 unknown command -1073488791
[  967.784979] binder: 16893:16898 ioctl c0306201 20000380 returned -22
[  967.785227] binder: undelivered TRANSACTION_ERROR: 29189
[  967.892030] binder_alloc: 16910: binder_alloc_buf, no vma
[  967.892077] binder: 16910:16913 transaction failed 29189/-3, size 24-8 line 3137
[  967.894868] binder: 16910:16913 ioctl c0306201 200002c0 returned -14
[  967.895012] binder: undelivered TRANSACTION_ERROR: 29189
[  967.930888] binder_alloc: 16917: binder_alloc_buf, no vma
[  967.930935] binder: 16917:16920 transaction failed 29189/-3, size 24-8 line 3137
[  967.931494] binder: 16917:16920 Release 1 refcount change on invalid ref 1 ret -22
[  967.931500] binder: 16917:16920 unknown command -1073488791
[  967.931508] binder: 16917:16920 ioctl c0306201 20000380 returned -22
[  967.931713] binder: undelivered TRANSACTION_ERROR: 29189
[  968.042340] binder: BINDER_SET_CONTEXT_MGR already set
[  968.042349] binder: 16928:16937 ioctl 40046207 0 returned -16
[  968.042526] binder_alloc: 16934: binder_alloc_buf, no vma
[  968.042542] binder_alloc: 16934: binder_alloc_buf, no vma
[  968.042572] binder: 16928:16937 transaction failed 29189/-3, size 24-8 line 3137
[  968.042584] binder: 16934:16936 transaction failed 29189/-3, size 24-8 line 3137
[  968.042674] binder: 16928:16937 ioctl c0306201 200002c0 returned -14
[  968.042817] binder: undelivered TRANSACTION_ERROR: 29189
[  968.043643] binder: 16934:16936 Release 1 refcount change on invalid ref 1 ret -22
[  968.043649] binder: 16934:16936 unknown command -1073488791
[  968.043658] binder: 16934:16936 ioctl c0306201 20000380 returned -22
[  968.043791] binder: undelivered TRANSACTION_ERROR: 29189
[  968.156717] binder_alloc: 16949: binder_alloc_buf, no vma
[  968.158044] binder: 16949:16954 transaction failed 29189/-3, size 24-8 line 3137
[  968.158228] binder: 16949:16954 Release 1 refcount change on invalid ref 1 ret -22
[  968.158235] binder: 16949:16954 unknown command -1073488791
[  968.158243] binder: 16949:16954 ioctl c0306201 20000380 returned -22
[  968.158398] binder: undelivered TRANSACTION_ERROR: 29189
[  968.167399] binder_alloc: 16952: binder_alloc_buf, no vma
[  968.167444] binder: 16952:16957 transaction failed 29189/-3, size 24-8 line 3137
[  968.167545] binder: 16952:16957 ioctl c0306201 200002c0 returned -14
[  968.167683] binder: undelivered TRANSACTION_ERROR: 29189
[  968.298878] binder_alloc: 16971: binder_alloc_buf, no vma
[  968.298924] binder: 16971:16973 transaction failed 29189/-3, size 24-8 line 3137
[  968.299014] binder: 16971:16973 ioctl c0306201 200002c0 returned -14
[  968.299169] binder: undelivered TRANSACTION_ERROR: 29189
[  968.312416] binder_alloc: 16967: binder_alloc_buf, no vma
[  968.312462] binder: 16967:16972 transaction failed 29189/-3, size 24-8 line 3137
[  968.312603] binder: 16967:16972 Release 1 refcount change on invalid ref 1 ret -22
[  968.312610] binder: 16967:16972 unknown command -1073488791
[  968.312618] binder: 16967:16972 ioctl c0306201 20000380 returned -22
[  968.312775] binder: undelivered TRANSACTION_ERROR: 29189
[  968.429522] binder_alloc: 16988: binder_alloc_buf, no vma
[  968.429567] binder: 16988:16990 transaction failed 29189/-3, size 24-8 line 3137
[  968.430869] binder: 16988:16990 Release 1 refcount change on invalid ref 1 ret -22
[  968.430876] binder: 16988:16990 unknown command -1073488791
[  968.430885] binder: 16988:16990 ioctl c0306201 20000380 returned -22
[  968.431043] binder: undelivered TRANSACTION_ERROR: 29189
[  968.466722] binder_alloc: 16992: binder_alloc_buf, no vma
[  968.466768] binder: 16992:16998 transaction failed 29189/-3, size 24-8 line 3137
[  968.467298] binder: 16992:16998 ioctl c0306201 200002c0 returned -14
[  968.467455] binder: undelivered TRANSACTION_ERROR: 29189
[  968.561678] binder_alloc: 17006: binder_alloc_buf, no vma
[  968.561724] binder: 17006:17011 transaction failed 29189/-3, size 24-8 line 3137
[  968.561823] binder: 17006:17011 ioctl c0306201 200002c0 returned -14
[  968.561976] binder: undelivered TRANSACTION_ERROR: 29189
[  968.572092] binder_alloc: 17005: binder_alloc_buf, no vma
[  968.572146] binder: 17005:17009 transaction failed 29189/-3, size 24-8 line 3137
[  968.572337] binder: 17005:17009 Release 1 refcount change on invalid ref 1 ret -22
[  968.572344] binder: 17005:17009 unknown command -1073488791
[  968.572363] binder: 17005:17009 ioctl c0306201 20000380 returned -22
[  968.582998] binder: undelivered TRANSACTION_ERROR: 29189
[  968.667373] binder_alloc: 17023: binder_alloc_buf, no vma
[  968.667422] binder: 17023:17026 transaction failed 29189/-3, size 24-8 line 3137
[  968.668441] binder: 17023:17026 Release 1 refcount change on invalid ref 1 ret -22
[  968.668447] binder: 17023:17026 unknown command -1073488791
[  968.668456] binder: 17023:17026 ioctl c0306201 20000380 returned -22
[  968.668633] binder: undelivered TRANSACTION_ERROR: 29189
[  968.728941] binder_alloc: 17029: binder_alloc_buf, no vma
[  968.728987] binder: 17029:17033 transaction failed 29189/-3, size 24-8 line 3137
[  968.729075] binder: 17029:17033 ioctl c0306201 200002c0 returned -14
[  968.729221] binder: undelivered TRANSACTION_ERROR: 29189
[  968.812083] binder: 17039:17041 transaction failed 29189/-22, size 24-8 line 3014
[  968.812490] binder: undelivered TRANSACTION_ERROR: 29189
[  968.817954] binder_alloc: 17044: binder_alloc_buf, no vma
[  968.817999] binder: 17044:17046 transaction failed 29189/-3, size 24-8 line 3137
[  968.818087] binder: 17044:17046 ioctl c0306201 200002c0 returned -14
[  968.818217] binder: undelivered TRANSACTION_ERROR: 29189
[  968.910465] binder_alloc: 17059: binder_alloc_buf, no vma
[  968.910511] binder: 17059:17062 transaction failed 29189/-3, size 24-8 line 3137
[  968.910672] binder: 17059:17062 Release 1 refcount change on invalid ref 1 ret -22
[  968.910679] binder: 17059:17062 unknown command -1073488791
[  968.910687] binder: 17059:17062 ioctl c0306201 20000380 returned -22
[  968.910835] binder: undelivered TRANSACTION_ERROR: 29189
[  968.958999] binder_alloc: 17064: binder_alloc_buf, no vma
[  968.959044] binder: 17064:17066 transaction failed 29189/-3, size 24-8 line 3137
[  968.962887] binder: 17064:17066 ioctl c0306201 200002c0 returned -14
[  968.966730] binder: undelivered TRANSACTION_ERROR: 29189
[  969.011962] binder_alloc: 17076: binder_alloc_buf, no vma
[  969.012007] binder: 17076:17078 transaction failed 29189/-3, size 24-8 line 3137
[  969.012155] binder: 17076:17078 Release 1 refcount change on invalid ref 1 ret -22
[  969.012162] binder: 17076:17078 unknown command -1073488791
[  969.012169] binder: 17076:17078 ioctl c0306201 20000380 returned -22
[  969.012316] binder: undelivered TRANSACTION_ERROR: 29189
[  969.103192] binder_alloc: 17083: binder_alloc_buf, no vma
[  969.103237] binder: 17083:17092 transaction failed 29189/-3, size 24-8 line 3137
[  969.106222] binder: 17083:17092 ioctl c0306201 200002c0 returned -14
[  969.106377] binder: undelivered TRANSACTION_ERROR: 29189
[  969.123186] binder_alloc: 17091: binder_alloc_buf, no vma
[  969.123232] binder: 17091:17096 transaction failed 29189/-3, size 24-8 line 3137
[  969.124115] binder: 17091:17096 Release 1 refcount change on invalid ref 1 ret -22
[  969.124129] binder: 17091:17096 unknown command -1073488791
[  969.124137] binder: 17091:17096 ioctl c0306201 20000380 returned -22
[  969.124280] binder: undelivered TRANSACTION_ERROR: 29189
[  969.201784] binder_alloc: 17101: binder_alloc_buf, no vma
[  969.201830] binder: 17101:17106 transaction failed 29189/-3, size 24-8 line 3137
[  969.201927] binder: 17101:17106 ioctl c0306201 200002c0 returned -14
[  969.202059] binder: undelivered TRANSACTION_ERROR: 29189
[  969.304090] binder: BINDER_SET_CONTEXT_MGR already set
[  969.304098] binder: 17111:17112 ioctl 40046207 0 returned -16
[  969.304102] binder_alloc: 17115: binder_alloc_buf, no vma
[  969.304168] binder: 17115:17119 transaction failed 29189/-3, size 24-8 line 3137
[  969.304259] binder: 17115:17119 ioctl c0306201 200002c0 returned -14
[  969.304304] binder_alloc: 17115: binder_alloc_buf, no vma
[  969.304347] binder: 17111:17112 transaction failed 29189/-3, size 24-8 line 3137
[  969.304404] binder: undelivered TRANSACTION_ERROR: 29189
[  969.304996] binder: 17111:17112 Release 1 refcount change on invalid ref 1 ret -22
[  969.305002] binder: 17111:17112 unknown command -1073488791
[  969.305010] binder: 17111:17112 ioctl c0306201 20000380 returned -22
[  969.305158] binder: undelivered TRANSACTION_ERROR: 29189
[  969.404757] binder_alloc: 17129: binder_alloc_buf, no vma
[  969.404805] binder: 17129:17132 transaction failed 29189/-3, size 24-8 line 3137
[  969.404907] binder: 17129:17132 ioctl c0306201 200002c0 returned -14
[  969.405055] binder: undelivered TRANSACTION_ERROR: 29189
[  969.470377] binder_alloc: 17134: binder_alloc_buf, no vma
[  969.470424] binder: 17134:17143 transaction failed 29189/-3, size 24-8 line 3137
[  969.471410] binder: 17134:17143 Release 1 refcount change on invalid ref 1 ret -22
[  969.471417] binder: 17134:17143 unknown command -1073488791
[  969.471426] binder: 17134:17143 ioctl c0306201 20000380 returned -22
[  969.471599] binder: undelivered TRANSACTION_ERROR: 29189
[  969.493334] binder_alloc: 17144: binder_alloc_buf, no vma
[  969.493380] binder: 17144:17147 transaction failed 29189/-3, size 24-8 line 3137
[  969.493550] binder: 17144:17147 ioctl c0306201 200002c0 returned -14
[  969.493709] binder: undelivered TRANSACTION_ERROR: 29189
[  969.571203] binder_alloc: 17152: binder_alloc_buf, no vma
[  969.571248] binder: 17152:17158 transaction failed 29189/-3, size 24-8 line 3137
[  969.571416] binder: 17152:17158 Release 1 refcount change on invalid ref 1 ret -22
[  969.571422] binder: 17152:17158 unknown command -1073488791
[  969.571430] binder: 17152:17158 ioctl c0306201 20000380 returned -22
[  969.571571] binder: undelivered TRANSACTION_ERROR: 29189
[  969.616314] binder_alloc: 17162: binder_alloc_buf, no vma
[  969.616360] binder: 17162:17164 transaction failed 29189/-3, size 24-8 line 3137
[  969.617375] binder: 17162:17164 ioctl c0306201 200002c0 returned -14
[  969.617701] binder: undelivered TRANSACTION_ERROR: 29189
[  969.730946] binder_alloc: 17181: binder_alloc_buf, no vma
[  969.730992] binder: 17181:17183 transaction failed 29189/-3, size 24-8 line 3137
[  969.731390] binder: 17181:17183 ioctl c0306201 200002c0 returned -14
[  969.731511] binder: BINDER_SET_CONTEXT_MGR already set
[  969.731519] binder: 17175:17179 ioctl 40046207 0 returned -16
[  969.731537] binder: undelivered TRANSACTION_ERROR: 29189
[  969.731847] binder: 17175:17179 transaction failed 29189/-22, size 24-8 line 3014
[  969.731967] binder: 17175:17179 Release 1 refcount change on invalid ref 1 ret -22
[  969.731973] binder: 17175:17179 unknown command -1073488791
[  969.731980] binder: 17175:17179 ioctl c0306201 20000380 returned -22
[  969.732115] binder: undelivered TRANSACTION_ERROR: 29189
[  969.827899] binder_alloc: 17195: binder_alloc_buf, no vma
[  969.827945] binder: 17195:17198 transaction failed 29189/-3, size 24-8 line 3137
[  969.828895] binder: 17195:17198 Release 1 refcount change on invalid ref 1 ret -22
[  969.828902] binder: 17195:17198 unknown command -1073488791
[  969.828910] binder: 17195:17198 ioctl c0306201 20000380 returned -22
[  969.829048] binder: undelivered TRANSACTION_ERROR: 29189
[  969.858772] binder_alloc: 17196: binder_alloc_buf, no vma
[  969.858819] binder: 17196:17200 transaction failed 29189/-3, size 24-8 line 3137
[  969.858912] binder: 17196:17200 ioctl c0306201 200002c0 returned -14
[  969.859152] binder: undelivered TRANSACTION_ERROR: 29189
[  969.938835] binder_alloc: 17213: binder_alloc_buf, no vma
[  969.938879] binder: 17213:17216 transaction failed 29189/-3, size 24-8 line 3137
[  969.939040] binder: 17213:17216 Release 1 refcount change on invalid ref 1 ret -22
[  969.939047] binder: 17213:17216 unknown command -1073488791
[  969.939055] binder: 17213:17216 ioctl c0306201 20000380 returned -22
[  969.943417] binder: undelivered TRANSACTION_ERROR: 29189
[  969.990674] binder_alloc: 17220: binder_alloc_buf, no vma
[  969.990720] binder: 17220:17225 transaction failed 29189/-3, size 24-8 line 3137
[  969.990812] binder: 17220:17225 ioctl c0306201 200002c0 returned -14
[  969.990942] binder: undelivered TRANSACTION_ERROR: 29189
[  970.078700] binder_alloc: 17230: binder_alloc_buf, no vma
[  970.078746] binder: 17230:17232 transaction failed 29189/-3, size 24-8 line 3137
[  970.078852] binder: 17230:17232 ioctl c0306201 200002c0 returned -14
[  970.078998] binder: undelivered TRANSACTION_ERROR: 29189
[  970.103323] binder_alloc: 17235: binder_alloc_buf, no vma
[  970.103359] binder: 17235:17237 transaction failed 29189/-3, size 24-8 line 3137
[  970.103510] binder: 17235:17237 Release 1 refcount change on invalid ref 1 ret -22
[  970.103517] binder: 17235:17237 unknown command -1073488791
[  970.103525] binder: 17235:17237 ioctl c0306201 20000380 returned -22
[  970.104288] binder: undelivered TRANSACTION_ERROR: 29189
[  970.183692] binder_alloc: 17248: binder_alloc_buf, no vma
[  970.183740] binder: 17248:17249 transaction failed 29189/-3, size 24-8 line 3137
[  970.183848] binder: 17248:17249 ioctl c0306201 200002c0 returned -14
[  970.185047] binder: undelivered TRANSACTION_ERROR: 29189
[  970.215499] binder_alloc: 17247: binder_alloc_buf, no vma
[  970.215545] binder: 17247:17252 transaction failed 29189/-3, size 24-8 line 3137
[  970.215699] binder: 17247:17252 Release 1 refcount change on invalid ref 1 ret -22
[  970.215704] binder: 17247:17252 unknown command -1073488791
[  970.215712] binder: 17247:17252 ioctl c0306201 20000380 returned -22
[  970.215840] binder: undelivered TRANSACTION_ERROR: 29189
[  970.320897] binder_alloc: 17265: binder_alloc_buf, no vma
[  970.320942] binder: 17265:17267 transaction failed 29189/-3, size 24-8 line 3137
[  970.321036] binder: 17265:17267 ioctl c0306201 200002c0 returned -14
[  970.325091] binder: undelivered TRANSACTION_ERROR: 29189
[  970.334981] binder_alloc: 17268: binder_alloc_buf, no vma
[  970.335027] binder: 17268:17270 transaction failed 29189/-3, size 24-8 line 3137
[  970.335209] binder: 17268:17270 Release 1 refcount change on invalid ref 1 ret -22
[  970.335216] binder: 17268:17270 unknown command -1073488791
[  970.335223] binder: 17268:17270 ioctl c0306201 20000380 returned -22
[  970.336842] binder: undelivered TRANSACTION_ERROR: 29189
[  970.454027] binder_alloc: 17284: binder_alloc_buf, no vma
[  970.454074] binder: 17284:17286 transaction failed 29189/-3, size 24-8 line 3137
[  970.454228] binder: 17284:17286 Release 1 refcount change on invalid ref 1 ret -22
[  970.454234] binder: 17284:17286 unknown command -1073488791
[  970.454243] binder: 17284:17286 ioctl c0306201 20000380 returned -22
[  970.454398] binder: undelivered TRANSACTION_ERROR: 29189
[  970.462405] binder_alloc: 17283: binder_alloc_buf, no vma
[  970.462452] binder: 17283:17288 transaction failed 29189/-3, size 24-8 line 3137
[  970.463921] binder: 17283:17288 ioctl c0306201 200002c0 returned -14
[  970.464066] binder: undelivered TRANSACTION_ERROR: 29189
[  970.604608] binder_alloc: 17304: binder_alloc_buf, no vma
[  970.604666] binder: 17304:17306 transaction failed 29189/-3, size 24-8 line 3137
[  970.604849] binder: 17304:17306 Release 1 refcount change on invalid ref 1 ret -22
[  970.604855] binder: 17304:17306 unknown command -1073488791
[  970.604863] binder: 17304:17306 ioctl c0306201 20000380 returned -22
[  970.605007] binder: undelivered TRANSACTION_ERROR: 29189
[  970.609577] binder_alloc: 17305: binder_alloc_buf, no vma
[  970.609631] binder: 17305:17309 transaction failed 29189/-3, size 24-8 line 3137
[  970.609739] binder: 17305:17309 ioctl c0306201 200002c0 returned -14
[  970.610703] binder: undelivered TRANSACTION_ERROR: 29189
[  970.707163] binder_alloc: 17320: binder_alloc_buf, no vma
[  970.707220] binder: 17320:17322 transaction failed 29189/-3, size 24-8 line 3137
[  970.712823] binder: 17320:17322 Release 1 refcount change on invalid ref 1 ret -22
[  970.712831] binder: 17320:17322 unknown command -1073488791
[  970.712840] binder: 17320:17322 ioctl c0306201 20000380 returned -22
[  970.713013] binder: undelivered TRANSACTION_ERROR: 29189
[  970.754705] binder_alloc: 17325: binder_alloc_buf, no vma
[  970.754752] binder: 17325:17328 transaction failed 29189/-3, size 24-8 line 3137
[  970.754847] binder: 17325:17328 ioctl c0306201 200002c0 returned -14
[  970.754992] binder: undelivered TRANSACTION_ERROR: 29189
[  970.853444] binder_alloc: 17338: binder_alloc_buf, no vma
[  970.853491] binder: 17338:17342 transaction failed 29189/-3, size 24-8 line 3137
[  970.853634] binder: 17338:17342 Release 1 refcount change on invalid ref 1 ret -22
[  970.853641] binder: 17338:17342 unknown command -1073488791
[  970.853649] binder: 17338:17342 ioctl c0306201 20000380 returned -22
[  970.853804] binder: undelivered TRANSACTION_ERROR: 29189
[  970.855598] binder_alloc: 17345: binder_alloc_buf, no vma
[  970.855708] binder: 17345:17346 transaction failed 29189/-3, size 24-8 line 3137
[  970.855796] binder: 17345:17346 ioctl c0306201 200002c0 returned -14
[  970.855918] binder: undelivered TRANSACTION_ERROR: 29189
[  970.995448] binder_alloc: 17360: binder_alloc_buf, no vma
[  970.995493] binder: 17360:17363 transaction failed 29189/-3, size 24-8 line 3137
[  970.995669] binder: 17360:17363 ioctl c0306201 200002c0 returned -14
[  970.995825] binder: undelivered TRANSACTION_ERROR: 29189
[  971.026598] binder_alloc: 17362: binder_alloc_buf, no vma
[  971.027006] binder: 17362:17364 transaction failed 29189/-3, size 24-8 line 3137
[  971.027216] binder: 17362:17364 Release 1 refcount change on invalid ref 1 ret -22
[  971.027223] binder: 17362:17364 unknown command -1073488791
[  971.027231] binder: 17362:17364 ioctl c0306201 20000380 returned -22
[  971.027394] binder: undelivered TRANSACTION_ERROR: 29189
[  971.137163] binder_alloc: 17375: binder_alloc_buf, no vma
[  971.137207] binder: 17375:17376 transaction failed 29189/-3, size 24-8 line 3137
[  971.137310] binder: 17375:17376 ioctl c0306201 200002c0 returned -14
[  971.137447] binder: undelivered TRANSACTION_ERROR: 29189
[  971.203420] binder_alloc: 17385: binder_alloc_buf, no vma
[  971.203463] binder: 17385:17389 transaction failed 29189/-3, size 24-8 line 3137
[  971.204299] binder: 17385:17389 Release 1 refcount change on invalid ref 1 ret -22
[  971.204306] binder: 17385:17389 unknown command -1073488791
[  971.204314] binder: 17385:17389 ioctl c0306201 20000380 returned -22
[  971.204570] binder: undelivered TRANSACTION_ERROR: 29189
[  971.219636] binder_alloc: 17387: binder_alloc_buf, no vma
[  971.226645] binder: 17387:17388 transaction failed 29189/-3, size 24-8 line 3137
[  971.226758] binder: 17387:17388 ioctl c0306201 200002c0 returned -14
[  971.226968] binder: undelivered TRANSACTION_ERROR: 29189
[  971.337734] binder_alloc: 17402: binder_alloc_buf, no vma
[  971.337780] binder: 17402:17408 transaction failed 29189/-3, size 24-8 line 3137
[  971.337885] binder: 17402:17408 ioctl c0306201 200002c0 returned -14
[  971.338018] binder: undelivered TRANSACTION_ERROR: 29189
[  971.341247] binder_alloc: 17401: binder_alloc_buf, no vma
[  971.341292] binder: 17401:17406 transaction failed 29189/-3, size 24-8 line 3137
[  971.341462] binder: 17401:17406 Release 1 refcount change on invalid ref 1 ret -22
[  971.341468] binder: 17401:17406 unknown command -1073488791
[  971.341476] binder: 17401:17406 ioctl c0306201 20000380 returned -22
[  971.341635] binder: undelivered TRANSACTION_ERROR: 29189
[  971.472094] binder_alloc: 17420: binder_alloc_buf, no vma
[  971.472148] binder: 17420:17425 transaction failed 29189/-3, size 24-8 line 3137
[  971.472322] binder: 17420:17425 Release 1 refcount change on invalid ref 1 ret -22
[  971.472328] binder: 17420:17425 unknown command -1073488791
[  971.472336] binder: 17420:17425 ioctl c0306201 20000380 returned -22
[  971.472495] binder: undelivered TRANSACTION_ERROR: 29189
[  971.500693] binder_alloc: 17427: binder_alloc_buf, no vma
[  971.500740] binder: 17427:17430 transaction failed 29189/-3, size 24-8 line 3137
[  971.500843] binder: 17427:17430 ioctl c0306201 200002c0 returned -14
[  971.506532] binder: undelivered TRANSACTION_ERROR: 29189
[  971.780146] binder_alloc: 17439: binder_alloc_buf, no vma
[  971.780194] binder: 17439:17442 transaction failed 29189/-3, size 24-8 line 3137
[  971.781645] binder: 17439:17442 Release 1 refcount change on invalid ref 1 ret -22
[  971.781651] binder: 17439:17442 unknown command -1073488791
[  971.781660] binder: 17439:17442 ioctl c0306201 20000380 returned -22
[  971.781831] binder: undelivered TRANSACTION_ERROR: 29189
[  972.017698] binder_alloc: 17455: binder_alloc_buf, no vma
[  972.017744] binder: 17455:17458 transaction failed 29189/-3, size 24-8 line 3137
[  972.017890] binder: 17455:17458 Release 1 refcount change on invalid ref 1 ret -22
[  972.017896] binder: 17455:17458 unknown command -1073488791
[  972.017905] binder: 17455:17458 ioctl c0306201 20000380 returned -22
[  972.018044] binder: undelivered TRANSACTION_ERROR: 29189
[  972.024762] binder_alloc: 17450: binder_alloc_buf, no vma
[  972.024804] binder: 17450:17456 transaction failed 29189/-3, size 24-8 line 3137
[  972.024979] binder: 17450:17456 ioctl c0306201 200002c0 returned -14
[  972.025115] binder: undelivered TRANSACTION_ERROR: 29189
[  972.134062] binder_alloc: 17471: binder_alloc_buf, no vma
[  972.134105] binder: 17471:17473 transaction failed 29189/-3, size 24-8 line 3137
[  972.134813] binder: 17471:17473 ioctl c0306201 200002c0 returned -14
[  972.134954] binder: undelivered TRANSACTION_ERROR: 29189
[  972.155457] binder_alloc: 17474: binder_alloc_buf, no vma
[  972.155503] binder: 17474:17477 transaction failed 29189/-3, size 24-8 line 3137
[  972.155669] binder: 17474:17477 Release 1 refcount change on invalid ref 1 ret -22
[  972.155676] binder: 17474:17477 unknown command -1073488791
[  972.155684] binder: 17474:17477 ioctl c0306201 20000380 returned -22
[  972.155826] binder: undelivered TRANSACTION_ERROR: 29189
[  972.244944] binder_alloc: 17490: binder_alloc_buf, no vma
[  972.244990] binder: 17490:17493 transaction failed 29189/-3, size 24-8 line 3137
[  972.245095] binder: 17490:17493 ioctl c0306201 200002c0 returned -14
[  972.245234] binder: undelivered TRANSACTION_ERROR: 29189
[  972.298671] binder_alloc: 17492: binder_alloc_buf, no vma
[  972.298718] binder: 17492:17498 transaction failed 29189/-3, size 24-8 line 3137
[  972.299206] binder: 17492:17498 Release 1 refcount change on invalid ref 1 ret -22
[  972.299212] binder: 17492:17498 unknown command -1073488791
[  972.299220] binder: 17492:17498 ioctl c0306201 20000380 returned -22
[  972.299374] binder: undelivered TRANSACTION_ERROR: 29189
[  972.380517] binder_alloc: 17508: binder_alloc_buf, no vma
[  972.380565] binder: 17508:17512 transaction failed 29189/-3, size 24-8 line 3137
[  972.382808] binder: 17508:17512 ioctl c0306201 200002c0 returned -14
[  972.384292] binder: undelivered TRANSACTION_ERROR: 29189
[  972.401729] binder_alloc: 17513: binder_alloc_buf, no vma
[  972.401774] binder: 17513:17516 transaction failed 29189/-3, size 24-8 line 3137
[  972.407167] binder: 17513:17516 Release 1 refcount change on invalid ref 1 ret -22
[  972.407174] binder: 17513:17516 unknown command -1073488791
[  972.407182] binder: 17513:17516 ioctl c0306201 20000380 returned -22
[  972.407352] binder: undelivered TRANSACTION_ERROR: 29189
[  972.501581] binder_alloc: 17526: binder_alloc_buf, no vma
[  972.501637] binder: 17526:17529 transaction failed 29189/-3, size 24-8 line 3137
[  972.510691] binder: 17526:17529 ioctl c0306201 200002c0 returned -14
[  972.510866] binder: undelivered TRANSACTION_ERROR: 29189
[  972.542977] binder_alloc: 17532: binder_alloc_buf, no vma
[  972.543023] binder: 17532:17535 transaction failed 29189/-3, size 24-8 line 3137
[  972.543184] binder: 17532:17535 Release 1 refcount change on invalid ref 1 ret -22
[  972.543191] binder: 17532:17535 unknown command -1073488791
[  972.543199] binder: 17532:17535 ioctl c0306201 20000380 returned -22
[  972.543360] binder: undelivered TRANSACTION_ERROR: 29189
[  972.621847] binder_alloc: 17544: binder_alloc_buf, no vma
[  972.621895] binder: 17544:17549 transaction failed 29189/-3, size 24-8 line 3137
[  972.622003] binder: 17544:17549 ioctl c0306201 200002c0 returned -14
[  972.622153] binder: undelivered TRANSACTION_ERROR: 29189
[  972.667604] binder_alloc: 17550: binder_alloc_buf, no vma
[  972.667660] binder: 17550:17555 transaction failed 29189/-3, size 24-8 line 3137
[  972.667825] binder: 17550:17555 Release 1 refcount change on invalid ref 1 ret -22
[  972.667831] binder: 17550:17555 unknown command -1073488791
[  972.667839] binder: 17550:17555 ioctl c0306201 20000380 returned -22
[  972.667998] binder: undelivered TRANSACTION_ERROR: 29189
[  972.735841] binder_alloc: 17561: binder_alloc_buf, no vma
[  972.735886] binder: 17561:17562 transaction failed 29189/-3, size 24-8 line 3137
[  972.735981] binder: 17561:17562 ioctl c0306201 200002c0 returned -14
[  972.736123] binder: undelivered TRANSACTION_ERROR: 29189
[  972.817785] binder_alloc: 17569: binder_alloc_buf, no vma
[  972.817834] binder: 17569:17573 transaction failed 29189/-3, size 24-8 line 3137
[  972.818011] binder: 17569:17573 Release 1 refcount change on invalid ref 1 ret -22
[  972.818018] binder: 17569:17573 unknown command -1073488791
[  972.818026] binder: 17569:17573 ioctl c0306201 20000380 returned -22
[  972.818342] binder: undelivered TRANSACTION_ERROR: 29189
[  972.858769] binder_alloc: 17579: binder_alloc_buf, no vma
[  972.858815] binder: 17579:17580 transaction failed 29189/-3, size 24-8 line 3137
[  972.858915] binder: 17579:17580 ioctl c0306201 200002c0 returned -14
[  972.859060] binder: undelivered TRANSACTION_ERROR: 29189
[  972.895786] binder_alloc: 17585: binder_alloc_buf, no vma
[  972.895832] binder: 17585:17587 transaction failed 29189/-3, size 24-8 line 3137
[  972.897152] binder: 17585:17587 Release 1 refcount change on invalid ref 1 ret -22
[  972.897158] binder: 17585:17587 unknown command -1073488791
[  972.897166] binder: 17585:17587 ioctl c0306201 20000380 returned -22
[  972.897495] binder: undelivered TRANSACTION_ERROR: 29189
[  972.931279] binder_alloc: 17595: binder_alloc_buf, no vma
[  972.931325] binder: 17595:17597 transaction failed 29189/-3, size 24-8 line 3137
[  972.931432] binder: 17595:17597 ioctl c0306201 200002c0 returned -14
[  972.935552] binder: undelivered TRANSACTION_ERROR: 29189
[  973.023119] binder_alloc: 17609: binder_alloc_buf, no vma
[  973.023163] binder: 17609:17611 transaction failed 29189/-3, size 24-8 line 3137
[  973.023868] binder: 17609:17611 ioctl c0306201 200002c0 returned -14
[  973.024025] binder: undelivered TRANSACTION_ERROR: 29189
[  973.067133] binder_alloc: 17607: binder_alloc_buf, no vma
[  973.067180] binder: 17607:17612 transaction failed 29189/-3, size 24-8 line 3137
[  973.078317] binder: 17607:17612 Release 1 refcount change on invalid ref 1 ret -22
[  973.078325] binder: 17607:17612 unknown command -1073488791
[  973.078333] binder: 17607:17612 ioctl c0306201 20000380 returned -22
[  973.078498] binder: undelivered TRANSACTION_ERROR: 29189
[  973.163266] binder_alloc: 17626: binder_alloc_buf, no vma
[  973.163318] binder: 17626:17627 transaction failed 29189/-3, size 24-8 line 3137
[  973.164312] binder: 17626:17627 ioctl c0306201 200002c0 returned -14
[  973.166784] binder: undelivered TRANSACTION_ERROR: 29189
[  973.199699] binder_alloc: 17633: binder_alloc_buf, no vma
[  973.199746] binder: 17633:17636 transaction failed 29189/-3, size 24-8 line 3137
[  973.199930] binder: 17633:17636 Release 1 refcount change on invalid ref 1 ret -22
[  973.199937] binder: 17633:17636 unknown command -1073488791
[  973.199945] binder: 17633:17636 ioctl c0306201 20000380 returned -22
[  973.200103] binder: undelivered TRANSACTION_ERROR: 29189
[  973.244109] binder_alloc: 17640: binder_alloc_buf, no vma
[  973.244329] binder: 17640:17641 transaction failed 29189/-3, size 24-8 line 3137
[  973.245024] binder: 17640:17641 ioctl c0306201 200002c0 returned -14
[  973.245174] binder: undelivered TRANSACTION_ERROR: 29189
[  973.335365] binder_alloc: 17651: binder_alloc_buf, no vma
[  973.335410] binder: 17651:17655 transaction failed 29189/-3, size 24-8 line 3137
[  973.335881] binder: 17651:17655 Release 1 refcount change on invalid ref 1 ret -22
[  973.335888] binder: 17651:17655 unknown command -1073488791
[  973.335895] binder: 17651:17655 ioctl c0306201 20000380 returned -22
[  973.336053] binder: undelivered TRANSACTION_ERROR: 29189
[  973.392168] binder_alloc: 17659: binder_alloc_buf, no vma
[  973.392222] binder: 17659:17662 transaction failed 29189/-3, size 24-8 line 3137
[  973.392316] binder: 17659:17662 ioctl c0306201 200002c0 returned -14
[  973.397550] binder: undelivered TRANSACTION_ERROR: 29189
[  973.522974] binder_alloc: 17670: binder_alloc_buf, no vma
[  973.523024] binder: 17670:17676 transaction failed 29189/-3, size 24-8 line 3137
[  973.523206] binder: 17670:17676 Release 1 refcount change on invalid ref 1 ret -22
[  973.523213] binder: 17670:17676 unknown command -1073488791
[  973.523221] binder: 17670:17676 ioctl c0306201 20000380 returned -22
[  973.523464] binder: undelivered TRANSACTION_ERROR: 29189
[  973.535292] binder_alloc: 17679: binder_alloc_buf, no vma
[  973.535337] binder: 17679:17682 transaction failed 29189/-3, size 24-8 line 3137
[  973.535546] binder: 17679:17682 ioctl c0306201 200002c0 returned -14
[  973.535764] binder: undelivered TRANSACTION_ERROR: 29189
[  973.601832] binder_alloc: 17694: binder_alloc_buf, no vma
[  973.601886] binder: 17694:17696 transaction failed 29189/-3, size 24-8 line 3137
[  973.626346] binder: 17694:17696 Release 1 refcount change on invalid ref 1 ret -22
[  973.626355] binder: 17694:17696 unknown command -1073488791
[  973.626365] binder: 17694:17696 ioctl c0306201 20000380 returned -22
[  973.626593] binder: undelivered TRANSACTION_ERROR: 29189
[  973.653467] binder_alloc: 17695: binder_alloc_buf, no vma
[  973.653510] binder: 17695:17699 transaction failed 29189/-3, size 24-8 line 3137
[  973.653607] binder: 17695:17699 ioctl c0306201 200002c0 returned -14
[  973.653767] binder: undelivered TRANSACTION_ERROR: 29189
[  973.737128] binder_alloc: 17710: binder_alloc_buf, no vma
[  973.737174] binder: 17710:17712 transaction failed 29189/-3, size 24-8 line 3137
[  973.738855] binder: 17710:17712 Release 1 refcount change on invalid ref 1 ret -22
[  973.738862] binder: 17710:17712 unknown command -1073488791
[  973.738870] binder: 17710:17712 ioctl c0306201 20000380 returned -22
[  973.739010] binder: undelivered TRANSACTION_ERROR: 29189
[  973.805825] binder_alloc: 17715: binder_alloc_buf, no vma
[  973.805872] binder: 17715:17719 transaction failed 29189/-3, size 24-8 line 3137
[  973.807226] binder: 17715:17719 ioctl c0306201 200002c0 returned -14
[  973.807364] binder: undelivered TRANSACTION_ERROR: 29189
[  973.839909] binder_alloc: 17724: binder_alloc_buf, no vma
[  973.839955] binder: 17724:17728 transaction failed 29189/-3, size 24-8 line 3137
[  973.840120] binder: 17724:17728 Release 1 refcount change on invalid ref 1 ret -22
[  973.840125] binder: 17724:17728 unknown command -1073488791
[  973.840135] binder: 17724:17728 ioctl c0306201 20000380 returned -22
[  973.840470] binder: undelivered TRANSACTION_ERROR: 29189
[  973.952617] binder_alloc: 17737: binder_alloc_buf, no vma
[  973.952663] binder: 17737:17745 transaction failed 29189/-3, size 24-8 line 3137
[  973.954097] binder: 17737:17745 ioctl c0306201 200002c0 returned -14
[  973.954397] binder: undelivered TRANSACTION_ERROR: 29189
[  973.961601] binder_alloc: 17743: binder_alloc_buf, no vma
[  973.961655] binder: 17743:17748 transaction failed 29189/-3, size 24-8 line 3137
[  973.961804] binder: 17743:17748 Release 1 refcount change on invalid ref 1 ret -22
[  973.961811] binder: 17743:17748 unknown command -1073488791
[  973.961819] binder: 17743:17748 ioctl c0306201 20000380 returned -22
[  973.961973] binder: undelivered TRANSACTION_ERROR: 29189
[  974.099394] binder_alloc: 17765: binder_alloc_buf, no vma
[  974.099441] binder: 17765:17769 transaction failed 29189/-3, size 24-8 line 3137
[  974.099588] binder: 17765:17769 Release 1 refcount change on invalid ref 1 ret -22
[  974.099594] binder: 17765:17769 unknown command -1073488791
[  974.099602] binder: 17765:17769 ioctl c0306201 20000380 returned -22
[  974.099768] binder: undelivered TRANSACTION_ERROR: 29189
[  974.104861] binder_alloc: 17760: binder_alloc_buf, no vma
[  974.104905] binder: 17760:17766 transaction failed 29189/-3, size 24-8 line 3137
[  974.105247] binder: 17760:17766 ioctl c0306201 200002c0 returned -14
[  974.113042] binder: undelivered TRANSACTION_ERROR: 29189
[  974.231708] binder_alloc: 17783: binder_alloc_buf, no vma
[  974.231753] binder: 17783:17786 transaction failed 29189/-3, size 24-8 line 3137
[  974.233067] binder: 17783:17786 Release 1 refcount change on invalid ref 1 ret -22
[  974.233263] binder: 17783:17786 unknown command -1073488791
[  974.233273] binder: 17783:17786 ioctl c0306201 20000380 returned -22
[  974.233516] binder: undelivered TRANSACTION_ERROR: 29189
[  974.237288] binder_alloc: 17780: binder_alloc_buf, no vma
[  974.237331] binder: 17780:17784 transaction failed 29189/-3, size 24-8 line 3137
[  974.238432] binder: 17780:17784 ioctl c0306201 200002c0 returned -14
[  974.238598] binder: undelivered TRANSACTION_ERROR: 29189
[  974.359196] binder_alloc: 17799: binder_alloc_buf, no vma
[  974.359241] binder: 17799:17804 transaction failed 29189/-3, size 24-8 line 3137
[  974.359830] binder: 17799:17804 Release 1 refcount change on invalid ref 1 ret -22
[  974.359837] binder: 17799:17804 unknown command -1073488791
[  974.359845] binder: 17799:17804 ioctl c0306201 20000380 returned -22
[  974.360007] binder: undelivered TRANSACTION_ERROR: 29189
[  974.389845] binder_alloc: 17805: binder_alloc_buf, no vma
[  974.389991] binder: 17805:17809 transaction failed 29189/-3, size 24-8 line 3137
[  974.390092] binder: 17805:17809 ioctl c0306201 200002c0 returned -14
[  974.390229] binder: undelivered TRANSACTION_ERROR: 29189
[  974.482612] binder_alloc: 17816: binder_alloc_buf, no vma
[  974.482665] binder: 17816:17821 transaction failed 29189/-3, size 24-8 line 3137
[  974.482830] binder: 17816:17821 Release 1 refcount change on invalid ref 1 ret -22
[  974.482836] binder: 17816:17821 unknown command -1073488791
[  974.482844] binder: 17816:17821 ioctl c0306201 20000380 returned -22
[  974.482984] binder: undelivered TRANSACTION_ERROR: 29189
[  974.531239] binder_alloc: 17823: binder_alloc_buf, no vma
[  974.531286] binder: 17823:17825 transaction failed 29189/-3, size 24-8 line 3137
[  974.531772] binder: 17823:17825 ioctl c0306201 200002c0 returned -14
[  974.531916] binder: undelivered TRANSACTION_ERROR: 29189
[  974.598899] binder_alloc: 17834: binder_alloc_buf, no vma
[  974.598944] binder: 17834:17840 transaction failed 29189/-3, size 24-8 line 3137
[  974.600165] binder: 17834:17840 Release 1 refcount change on invalid ref 1 ret -22
[  974.600172] binder: 17834:17840 unknown command -1073488791
[  974.600180] binder: 17834:17840 ioctl c0306201 20000380 returned -22
[  974.600352] binder: undelivered TRANSACTION_ERROR: 29189
[  974.631407] binder_alloc: 17839: binder_alloc_buf, no vma
[  974.631452] binder: 17839:17843 transaction failed 29189/-3, size 24-8 line 3137
[  974.641659] binder: 17839:17843 ioctl c0306201 200002c0 returned -14
[  974.647994] binder: undelivered TRANSACTION_ERROR: 29189
[  974.721432] binder_alloc: 17854: binder_alloc_buf, no vma
[  974.721485] binder: 17854:17855 transaction failed 29189/-3, size 24-8 line 3137
[  974.721657] binder: 17854:17855 Release 1 refcount change on invalid ref 1 ret -22
[  974.721663] binder: 17854:17855 unknown command -1073488791
[  974.721671] binder: 17854:17855 ioctl c0306201 20000380 returned -22
[  974.721815] binder: undelivered TRANSACTION_ERROR: 29189
[  974.795338] binder_alloc: 17860: binder_alloc_buf, no vma
[  974.795384] binder: 17860:17863 transaction failed 29189/-3, size 24-8 line 3137
[  974.795475] binder: 17860:17863 ioctl c0306201 200002c0 returned -14
[  974.795613] binder: undelivered TRANSACTION_ERROR: 29189
[  974.864528] binder_alloc: 17871: binder_alloc_buf, no vma
[  974.864576] binder: 17871:17879 transaction failed 29189/-3, size 24-8 line 3137
[  974.866577] binder: 17871:17879 Release 1 refcount change on invalid ref 1 ret -22
[  974.866756] binder: 17871:17879 unknown command -1073488791
[  974.866765] binder: 17871:17879 ioctl c0306201 20000380 returned -22
[  974.867032] binder: undelivered TRANSACTION_ERROR: 29189
[  974.890882] binder_alloc: 17878: binder_alloc_buf, no vma
[  974.890930] binder: 17878:17880 transaction failed 29189/-3, size 24-8 line 3137
[  974.891020] binder: 17878:17880 ioctl c0306201 200002c0 returned -14
[  974.891161] binder: undelivered TRANSACTION_ERROR: 29189
[  974.991909] binder_alloc: 17891: binder_alloc_buf, no vma
[  974.991957] binder: 17891:17896 transaction failed 29189/-3, size 24-8 line 3137
[  975.002333] binder: 17891:17896 Release 1 refcount change on invalid ref 1 ret -22
[  975.002341] binder: 17891:17896 unknown command -1073488791
[  975.002350] binder: 17891:17896 ioctl c0306201 20000380 returned -22
[  975.002493] binder: undelivered TRANSACTION_ERROR: 29189
[  975.045594] binder_alloc: 17897: binder_alloc_buf, no vma
[  975.045649] binder: 17897:17899 transaction failed 29189/-3, size 24-8 line 3137
[  975.045743] binder: 17897:17899 ioctl c0306201 200002c0 returned -14
[  975.046075] binder: undelivered TRANSACTION_ERROR: 29189
[  975.114897] binder_alloc: 17910: binder_alloc_buf, no vma
[  975.114943] binder: 17910:17914 transaction failed 29189/-3, size 24-8 line 3137
[  975.116215] binder: 17910:17914 Release 1 refcount change on invalid ref 1 ret -22
[  975.116223] binder: 17910:17914 unknown command -1073488791
[  975.116232] binder: 17910:17914 ioctl c0306201 20000380 returned -22
[  975.131253] binder: undelivered TRANSACTION_ERROR: 29189
[  975.151360] binder_alloc: 17911: binder_alloc_buf, no vma
[  975.151405] binder: 17911:17916 transaction failed 29189/-3, size 24-8 line 3137
[  975.151494] binder: 17911:17916 ioctl c0306201 200002c0 returned -14
[  975.151638] binder: undelivered TRANSACTION_ERROR: 29189
[  975.258758] binder_alloc: 17932: binder_alloc_buf, no vma
[  975.258805] binder: 17932:17937 transaction failed 29189/-3, size 24-8 line 3137
[  975.258923] binder: 17932:17937 ioctl c0306201 200002c0 returned -14
[  975.259056] binder: undelivered TRANSACTION_ERROR: 29189
[  975.284105] binder_alloc: 17933: binder_alloc_buf, no vma
[  975.284157] binder: 17933:17935 transaction failed 29189/-3, size 24-8 line 3137
[  975.285216] binder: 17933:17935 Release 1 refcount change on invalid ref 1 ret -22
[  975.285222] binder: 17933:17935 unknown command -1073488791
[  975.285231] binder: 17933:17935 ioctl c0306201 20000380 returned -22
[  975.288495] binder: undelivered TRANSACTION_ERROR: 29189
[  975.353144] binder_alloc: 17943: binder_alloc_buf, no vma
[  975.353190] binder: 17943:17948 transaction failed 29189/-3, size 24-8 line 3137
[  975.353287] binder: 17943:17948 ioctl c0306201 200002c0 returned -14
[  975.353435] binder: undelivered TRANSACTION_ERROR: 29189
[  975.412325] binder_alloc: 17951: binder_alloc_buf, no vma
[  975.412370] binder: 17951:17954 transaction failed 29189/-3, size 24-8 line 3137
[  975.412517] binder: 17951:17954 Release 1 refcount change on invalid ref 1 ret -22
[  975.412523] binder: 17951:17954 unknown command -1073488791
[  975.412531] binder: 17951:17954 ioctl c0306201 20000380 returned -22
[  975.412697] binder: undelivered TRANSACTION_ERROR: 29189
[  975.439472] binder_alloc: 17957: binder_alloc_buf, no vma
[  975.439519] binder: 17957:17960 transaction failed 29189/-3, size 24-8 line 3137
[  975.439615] binder: 17957:17960 ioctl c0306201 200002c0 returned -14
[  975.439857] binder: undelivered TRANSACTION_ERROR: 29189
[  975.528354] binder_alloc: 17971: binder_alloc_buf, no vma
[  975.528401] binder: 17971:17974 transaction failed 29189/-3, size 24-8 line 3137
[  975.528697] binder: 17971:17974 Release 1 refcount change on invalid ref 1 ret -22
[  975.528704] binder: 17971:17974 unknown command -1073488791
[  975.528712] binder: 17971:17974 ioctl c0306201 20000380 returned -22
[  975.529824] binder: undelivered TRANSACTION_ERROR: 29189
[  975.531690] binder_alloc: 17972: binder_alloc_buf, no vma
[  975.531735] binder: 17972:17975 transaction failed 29189/-3, size 24-8 line 3137
[  975.531828] binder: 17972:17975 ioctl c0306201 200002c0 returned -14
[  975.537258] binder: undelivered TRANSACTION_ERROR: 29189
[  975.618620] binder_alloc: 17982: binder_alloc_buf, no vma
[  975.618666] binder: 17982:17983 transaction failed 29189/-3, size 24-8 line 3137
[  975.618829] binder: 17982:17983 Release 1 refcount change on invalid ref 1 ret -22
[  975.618836] binder: 17982:17983 unknown command -1073488791
[  975.618844] binder: 17982:17983 ioctl c0306201 20000380 returned -22
[  975.619099] binder: undelivered TRANSACTION_ERROR: 29189
[  975.660570] binder_alloc: 17987: binder_alloc_buf, no vma
[  975.660614] binder: 17987:17992 transaction failed 29189/-3, size 24-8 line 3137
[  975.660737] binder: 17987:17992 ioctl c0306201 200002c0 returned -14
[  975.660868] binder: undelivered TRANSACTION_ERROR: 29189
[  975.739797] binder_alloc: 18000: binder_alloc_buf, no vma
[  975.739843] binder: 18000:18002 transaction failed 29189/-3, size 24-8 line 3137
[  975.740546] binder: 18000:18002 Release 1 refcount change on invalid ref 1 ret -22
[  975.740553] binder: 18000:18002 unknown command -1073488791
[  975.740563] binder: 18000:18002 ioctl c0306201 20000380 returned -22
[  975.740780] binder: undelivered TRANSACTION_ERROR: 29189
[  975.781220] binder_alloc: 18005: binder_alloc_buf, no vma
[  975.781266] binder: 18005:18008 transaction failed 29189/-3, size 24-8 line 3137
[  975.781459] binder: 18005:18008 ioctl c0306201 200002c0 returned -14
[  975.781606] binder: undelivered TRANSACTION_ERROR: 29189
[  975.869291] binder_alloc: 18018: binder_alloc_buf, no vma
[  975.869338] binder: 18018:18021 transaction failed 29189/-3, size 24-8 line 3137
[  975.870008] binder: 18018:18021 ioctl c0306201 200002c0 returned -14
[  975.870153] binder: undelivered TRANSACTION_ERROR: 29189
[  975.890229] binder_alloc: 18016: binder_alloc_buf, no vma
[  975.890274] binder: 18016:18025 transaction failed 29189/-3, size 24-8 line 3137
[  975.892920] binder: 18016:18025 Release 1 refcount change on invalid ref 1 ret -22
[  975.892927] binder: 18016:18025 unknown command -1073488791
[  975.892935] binder: 18016:18025 ioctl c0306201 20000380 returned -22
[  975.893557] binder: undelivered TRANSACTION_ERROR: 29189
[  975.978941] binder_alloc: 18035: binder_alloc_buf, no vma
[  975.978987] binder: 18035:18036 transaction failed 29189/-3, size 24-8 line 3137
[  975.979089] binder: 18035:18036 ioctl c0306201 200002c0 returned -14
[  975.979231] binder: undelivered TRANSACTION_ERROR: 29189
[  976.048321] binder_alloc: 18041: binder_alloc_buf, no vma
[  976.048367] binder: 18041:18044 transaction failed 29189/-3, size 24-8 line 3137
[  976.048544] binder: 18041:18044 Release 1 refcount change on invalid ref 1 ret -22
[  976.048551] binder: 18041:18044 unknown command -1073488791
[  976.048559] binder: 18041:18044 ioctl c0306201 20000380 returned -22
[  976.048699] binder: undelivered TRANSACTION_ERROR: 29189
[  976.139863] binder_alloc: 18060: binder_alloc_buf, no vma
[  976.140914] binder: 18060:18063 transaction failed 29189/-3, size 24-8 line 3137
[  976.141249] binder: 18060:18063 Release 1 refcount change on invalid ref 1 ret -22
[  976.141256] binder: 18060:18063 unknown command -1073488791
[  976.141265] binder: 18060:18063 ioctl c0306201 20000380 returned -22
[  976.141429] binder: undelivered TRANSACTION_ERROR: 29189
[  976.149179] binder_alloc: 18049: binder_alloc_buf, no vma
[  976.149223] binder: 18049:18064 transaction failed 29189/-3, size 24-8 line 3137
[  976.157250] binder: 18049:18064 ioctl c0306201 200002c0 returned -14
[  976.157397] binder: undelivered TRANSACTION_ERROR: 29189
[  976.276253] binder_alloc: 18076: binder_alloc_buf, no vma
[  976.276297] binder: 18076:18079 transaction failed 29189/-3, size 24-8 line 3137
[  976.277275] binder: 18076:18079 Release 1 refcount change on invalid ref 1 ret -22
[  976.277282] binder: 18076:18079 unknown command -1073488791
[  976.277290] binder: 18076:18079 ioctl c0306201 20000380 returned -22
[  976.281798] binder: undelivered TRANSACTION_ERROR: 29189
[  976.288262] binder_alloc: 18078: binder_alloc_buf, no vma
[  976.288307] binder: 18078:18082 transaction failed 29189/-3, size 24-8 line 3137
[  976.288735] binder: 18078:18082 ioctl c0306201 200002c0 returned -14
[  976.288867] binder: undelivered TRANSACTION_ERROR: 29189
[  976.393811] binder_alloc: 18092: binder_alloc_buf, no vma
[  976.393855] binder: 18092:18096 transaction failed 29189/-3, size 24-8 line 3137
[  976.394018] binder: 18092:18096 Release 1 refcount change on invalid ref 1 ret -22
[  976.394024] binder: 18092:18096 unknown command -1073488791
[  976.394032] binder: 18092:18096 ioctl c0306201 20000380 returned -22
[  976.394179] binder: undelivered TRANSACTION_ERROR: 29189
[  976.423054] binder_alloc: 18097: binder_alloc_buf, no vma
[  976.423098] binder: 18097:18101 transaction failed 29189/-3, size 24-8 line 3137
[  976.423295] binder: 18097:18101 ioctl c0306201 200002c0 returned -14
[  976.423441] binder: undelivered TRANSACTION_ERROR: 29189
[  976.489942] binder_alloc: 18109: binder_alloc_buf, no vma
[  976.489987] binder: 18109:18112 transaction failed 29189/-3, size 24-8 line 3137
[  976.492762] binder: 18109:18112 Release 1 refcount change on invalid ref 1 ret -22
[  976.492769] binder: 18109:18112 unknown command -1073488791
[  976.492778] binder: 18109:18112 ioctl c0306201 20000380 returned -22
[  976.492924] binder: undelivered TRANSACTION_ERROR: 29189
[  976.529787] binder_alloc: 18113: binder_alloc_buf, no vma
[  976.529833] binder: 18113:18118 transaction failed 29189/-3, size 24-8 line 3137
[  976.532533] binder: 18113:18118 ioctl c0306201 200002c0 returned -14
[  976.532699] binder: undelivered TRANSACTION_ERROR: 29189
[  976.672363] binder: BINDER_SET_CONTEXT_MGR already set
[  976.672371] binder: 18130:18136 ioctl 40046207 0 returned -16
[  976.672421] binder_alloc: 18131: binder_alloc_buf, no vma
[  976.672498] binder: 18131:18138 transaction failed 29189/-3, size 24-8 line 3137
[  976.672542] binder_alloc: 18131: binder_alloc_buf, no vma
[  976.672587] binder: 18130:18136 transaction failed 29189/-3, size 24-8 line 3137
[  976.672772] binder: 18130:18136 ioctl c0306201 200002c0 returned -14
[  976.672903] binder: undelivered TRANSACTION_ERROR: 29189
[  976.673122] binder: 18131:18138 Release 1 refcount change on invalid ref 1 ret -22
[  976.673129] binder: 18131:18138 unknown command -1073488791
[  976.673137] binder: 18131:18138 ioctl c0306201 20000380 returned -22
[  976.679763] binder: undelivered TRANSACTION_ERROR: 29189
[  976.785372] binder_alloc: 18151: binder_alloc_buf, no vma
[  976.785418] binder: 18151:18157 transaction failed 29189/-3, size 24-8 line 3137
[  976.787675] binder: BINDER_SET_CONTEXT_MGR already set
[  976.787684] binder: 18152:18158 ioctl 40046207 0 returned -16
[  976.787774] binder: 18151:18157 Release 1 refcount change on invalid ref 1 ret -22
[  976.787780] binder: 18151:18157 unknown command -1073488791
[  976.787787] binder: 18151:18157 ioctl c0306201 20000380 returned -22
[  976.787948] binder: undelivered TRANSACTION_ERROR: 29189
[  976.791054] binder: 18152:18158 transaction failed 29189/-22, size 24-8 line 3014
[  976.791147] binder: 18152:18158 ioctl c0306201 200002c0 returned -14
[  976.791282] binder: undelivered TRANSACTION_ERROR: 29189
[  976.902552] binder_alloc: 18169: binder_alloc_buf, no vma
[  976.902599] binder: 18169:18170 transaction failed 29189/-3, size 24-8 line 3137
[  976.902776] binder: 18169:18170 Release 1 refcount change on invalid ref 1 ret -22
[  976.902782] binder: 18169:18170 unknown command -1073488791
[  976.902791] binder: 18169:18170 ioctl c0306201 20000380 returned -22
[  976.902941] binder: undelivered TRANSACTION_ERROR: 29189
[  976.916864] binder_alloc: 18168: binder_alloc_buf, no vma
[  976.916907] binder: 18168:18175 transaction failed 29189/-3, size 24-8 line 3137
[  976.917019] binder: 18168:18175 ioctl c0306201 200002c0 returned -14
[  976.918267] binder: undelivered TRANSACTION_ERROR: 29189
[  977.331418] binder_alloc: 18186: binder_alloc_buf, no vma
[  977.331464] binder: 18186:18192 transaction failed 29189/-3, size 24-8 line 3137
[  977.331641] binder: 18186:18192 Release 1 refcount change on invalid ref 1 ret -22
[  977.331647] binder: 18186:18192 unknown command -1073488791
[  977.331656] binder: 18186:18192 ioctl c0306201 20000380 returned -22
[  977.331787] binder: undelivered TRANSACTION_ERROR: 29189
[  977.460139] binder_alloc: 18196: binder_alloc_buf, no vma
[  977.460184] binder: 18196:18198 transaction failed 29189/-3, size 24-8 line 3137
[  977.460781] binder: 18196:18198 Release 1 refcount change on invalid ref 1 ret -22
[  977.460788] binder: 18196:18198 unknown command -1073488791
[  977.460796] binder: 18196:18198 ioctl c0306201 20000380 returned -22
[  977.461232] binder: undelivered TRANSACTION_ERROR: 29189
[  977.464916] binder_alloc: 18195: binder_alloc_buf, no vma
[  977.464960] binder: 18195:18200 transaction failed 29189/-3, size 24-8 line 3137
[  977.465045] binder: 18195:18200 ioctl c0306201 200002c0 returned -14
[  977.469218] binder: undelivered TRANSACTION_ERROR: 29189
[  977.498638] binder_alloc: 18208: binder_alloc_buf, no vma
[  977.498684] binder: 18208:18209 transaction failed 29189/-3, size 24-8 line 3137
[  977.498972] binder: 18208:18209 Release 1 refcount change on invalid ref 1 ret -22
[  977.498978] binder: 18208:18209 unknown command -1073488791
[  977.498987] binder: 18208:18209 ioctl c0306201 20000380 returned -22
[  977.502366] binder: undelivered TRANSACTION_ERROR: 29189
[  977.579997] binder_alloc: 18215: binder_alloc_buf, no vma
[  977.580041] binder: 18215:18218 transaction failed 29189/-3, size 24-8 line 3137
[  977.580194] binder: 18215:18218 Release 1 refcount change on invalid ref 1 ret -22
[  977.580201] binder: 18215:18218 unknown command -1073488791
[  977.580210] binder: 18215:18218 ioctl c0306201 20000380 returned -22
[  977.581744] binder: undelivered TRANSACTION_ERROR: 29189
[  977.588184] binder_alloc: 18217: binder_alloc_buf, no vma
[  977.588228] binder: 18217:18221 transaction failed 29189/-3, size 24-8 line 3137
[  977.589428] binder: 18217:18221 ioctl c0306201 200002c0 returned -14
[  977.592139] binder: undelivered TRANSACTION_ERROR: 29189
[  977.711461] binder_alloc: 18235: binder_alloc_buf, no vma
[  977.711507] binder: 18235:18237 transaction failed 29189/-3, size 24-8 line 3137
[  977.722172] binder: 18235:18237 Release 1 refcount change on invalid ref 1 ret -22
[  977.722180] binder: 18235:18237 unknown command -1073488791
[  977.722188] binder: 18235:18237 ioctl c0306201 20000380 returned -22
[  977.726668] binder: undelivered TRANSACTION_ERROR: 29189
[  977.747067] binder_alloc: 18238: binder_alloc_buf, no vma
[  977.747110] binder: 18238:18242 transaction failed 29189/-3, size 24-8 line 3137
[  977.748006] binder: 18238:18242 ioctl c0306201 200002c0 returned -14
[  977.748185] binder: undelivered TRANSACTION_ERROR: 29189
[  977.840099] binder_alloc: 18254: binder_alloc_buf, no vma
[  977.840157] binder: 18254:18257 transaction failed 29189/-3, size 24-8 line 3137
[  977.844752] binder: 18254:18257 ioctl c0306201 200002c0 returned -14
[  977.844943] binder: undelivered TRANSACTION_ERROR: 29189
[  977.892508] binder_alloc: 18259: binder_alloc_buf, no vma
[  977.892555] binder: 18259:18261 transaction failed 29189/-3, size 24-8 line 3137
[  977.892802] binder: 18259:18261 Release 1 refcount change on invalid ref 1 ret -22
[  977.892859] binder: 18259:18261 unknown command -1073488791
[  977.892867] binder: 18259:18261 ioctl c0306201 20000380 returned -22
[  977.895119] binder: undelivered TRANSACTION_ERROR: 29189
[  977.981451] binder_alloc: 18270: binder_alloc_buf, no vma
[  977.981499] binder: 18270:18274 transaction failed 29189/-3, size 24-8 line 3137
[  977.981609] binder: 18270:18274 ioctl c0306201 200002c0 returned -14
[  977.981754] binder: undelivered TRANSACTION_ERROR: 29189
[  978.017870] binder_alloc: 18273: binder_alloc_buf, no vma
[  978.017915] binder: 18273:18281 transaction failed 29189/-3, size 24-8 line 3137
[  978.019948] binder: 18273:18281 Release 1 refcount change on invalid ref 1 ret -22
[  978.019955] binder: 18273:18281 unknown command -1073488791
[  978.019963] binder: 18273:18281 ioctl c0306201 20000380 returned -22
[  978.020144] binder: undelivered TRANSACTION_ERROR: 29189
[  978.095725] binder_alloc: 18287: binder_alloc_buf, no vma
[  978.095772] binder: 18287:18289 transaction failed 29189/-3, size 24-8 line 3137
[  978.095880] binder: 18287:18289 ioctl c0306201 200002c0 returned -14
[  978.096034] binder: undelivered TRANSACTION_ERROR: 29189
[  978.103868] binder_alloc: 18295: binder_alloc_buf, no vma
[  978.103914] binder: 18295:18296 transaction failed 29189/-3, size 24-8 line 3137
[  978.104131] binder: 18295:18296 Release 1 refcount change on invalid ref 1 ret -22
[  978.128247] binder: 18295:18296 unknown command -1073488791
[  978.128258] binder: 18295:18296 ioctl c0306201 20000380 returned -22
[  978.128450] binder: undelivered TRANSACTION_ERROR: 29189
[  978.209677] binder_alloc: 18305: binder_alloc_buf, no vma
[  978.209723] binder: 18305:18312 transaction failed 29189/-3, size 24-8 line 3137
[  978.209817] binder: 18305:18312 ioctl c0306201 200002c0 returned -14
[  978.209964] binder: undelivered TRANSACTION_ERROR: 29189
[  978.229581] binder_alloc: 18310: binder_alloc_buf, no vma
[  978.229774] binder: 18310:18314 transaction failed 29189/-3, size 24-8 line 3137
[  978.230204] binder: 18310:18314 Release 1 refcount change on invalid ref 1 ret -22
[  978.230211] binder: 18310:18314 unknown command -1073488791
[  978.230219] binder: 18310:18314 ioctl c0306201 20000380 returned -22
[  978.236532] binder: undelivered TRANSACTION_ERROR: 29189
[  978.343254] binder_alloc: 18324: binder_alloc_buf, no vma
[  978.343299] binder: 18324:18327 transaction failed 29189/-3, size 24-8 line 3137
[  978.344275] binder: 18324:18327 ioctl c0306201 200002c0 returned -14
[  978.344520] binder: undelivered TRANSACTION_ERROR: 29189
[  978.348004] binder_alloc: 18328: binder_alloc_buf, no vma
[  978.348048] binder: 18328:18332 transaction failed 29189/-3, size 24-8 line 3137
[  978.348220] binder: 18328:18332 Release 1 refcount change on invalid ref 1 ret -22
[  978.348227] binder: 18328:18332 unknown command -1073488791
[  978.348235] binder: 18328:18332 ioctl c0306201 20000380 returned -22
[  978.348428] binder: undelivered TRANSACTION_ERROR: 29189
[  978.462811] binder: BINDER_SET_CONTEXT_MGR already set
[  978.462821] binder: 18343:18345 ioctl 40046207 0 returned -16
[  978.462988] binder_alloc: 18344: binder_alloc_buf, no vma
[  978.463034] binder: 18343:18345 transaction failed 29189/-3, size 24-8 line 3137
[  978.463131] binder: 18343:18345 ioctl c0306201 200002c0 returned -14
[  978.463422] binder: undelivered TRANSACTION_ERROR: 29189
[  978.465530] binder_alloc: 18344: binder_alloc_buf, no vma
[  978.465574] binder: 18344:18349 transaction failed 29189/-3, size 24-8 line 3137
[  978.467962] binder: 18344:18349 Release 1 refcount change on invalid ref 1 ret -22
[  978.467969] binder: 18344:18349 unknown command -1073488791
[  978.467977] binder: 18344:18349 ioctl c0306201 20000380 returned -22
[  978.468249] binder: undelivered TRANSACTION_ERROR: 29189
[  978.558561] binder_alloc: 18359: binder_alloc_buf, no vma
[  978.558607] binder: 18359:18361 transaction failed 29189/-3, size 24-8 line 3137
[  978.559605] binder: 18359:18361 ioctl c0306201 200002c0 returned -14
[  978.559761] binder: undelivered TRANSACTION_ERROR: 29189
[  978.609478] binder_alloc: 18366: binder_alloc_buf, no vma
[  978.609522] binder: 18366:18371 transaction failed 29189/-3, size 24-8 line 3137
[  978.609675] binder: 18366:18371 Release 1 refcount change on invalid ref 1 ret -22
[  978.609682] binder: 18366:18371 unknown command -1073488791
[  978.609690] binder: 18366:18371 ioctl c0306201 20000380 returned -22
[  978.611607] binder: undelivered TRANSACTION_ERROR: 29189
[  978.720568] binder_alloc: 18381: binder_alloc_buf, no vma
[  978.721871] binder: 18381:18386 transaction failed 29189/-3, size 24-8 line 3137
[  978.721966] binder: 18381:18386 ioctl c0306201 200002c0 returned -14
[  978.722228] binder: undelivered TRANSACTION_ERROR: 29189
[  978.724700] binder_alloc: 18380: binder_alloc_buf, no vma
[  978.724743] binder: 18380:18384 transaction failed 29189/-3, size 24-8 line 3137
[  978.731951] binder: 18380:18384 Release 1 refcount change on invalid ref 1 ret -22
[  978.731958] binder: 18380:18384 unknown command -1073488791
[  978.731966] binder: 18380:18384 ioctl c0306201 20000380 returned -22
[  978.732133] binder: undelivered TRANSACTION_ERROR: 29189
[  978.828527] binder_alloc: 18395: binder_alloc_buf, no vma
[  978.828573] binder: 18395:18400 transaction failed 29189/-3, size 24-8 line 3137
[  978.828746] binder: 18395:18400 Release 1 refcount change on invalid ref 1 ret -22
[  978.828752] binder: 18395:18400 unknown command -1073488791
[  978.828761] binder: 18395:18400 ioctl c0306201 20000380 returned -22
[  978.828965] binder: undelivered TRANSACTION_ERROR: 29189
[  978.882135] binder_alloc: 18403: binder_alloc_buf, no vma
[  978.882182] binder: 18403:18404 transaction failed 29189/-3, size 24-8 line 3137
[  978.885923] binder: 18403:18404 ioctl c0306201 200002c0 returned -14
[  978.886084] binder: undelivered TRANSACTION_ERROR: 29189
[  978.942069] binder_alloc: 18413: binder_alloc_buf, no vma
[  978.942116] binder: 18413:18420 transaction failed 29189/-3, size 24-8 line 3137
[  978.943186] binder: 18413:18420 Release 1 refcount change on invalid ref 1 ret -22
[  978.943193] binder: 18413:18420 unknown command -1073488791
[  978.943201] binder: 18413:18420 ioctl c0306201 20000380 returned -22
[  978.943346] binder: undelivered TRANSACTION_ERROR: 29189
[  978.989100] binder_alloc: 18424: binder_alloc_buf, no vma
[  978.999804] binder: 18424:18425 transaction failed 29189/-3, size 24-8 line 3137
[  978.999911] binder: 18424:18425 ioctl c0306201 200002c0 returned -14
[  979.000063] binder: undelivered TRANSACTION_ERROR: 29189
[  979.081280] binder_alloc: 18439: binder_alloc_buf, no vma
[  979.081327] binder: 18439:18441 transaction failed 29189/-3, size 24-8 line 3137
[  979.089330] binder: 18439:18441 ioctl c0306201 200002c0 returned -14
[  979.096217] binder: undelivered TRANSACTION_ERROR: 29189
[  979.111091] binder_alloc: 18440: binder_alloc_buf, no vma
[  979.111143] binder: 18440:18444 transaction failed 29189/-3, size 24-8 line 3137
[  979.111325] binder: 18440:18444 Release 1 refcount change on invalid ref 1 ret -22
[  979.111332] binder: 18440:18444 unknown command -1073488791
[  979.111340] binder: 18440:18444 ioctl c0306201 20000380 returned -22
[  979.111651] binder: undelivered TRANSACTION_ERROR: 29189
[  979.222224] binder_alloc: 18456: binder_alloc_buf, no vma
[  979.222270] binder: 18456:18460 transaction failed 29189/-3, size 24-8 line 3137
[  979.222376] binder: 18456:18460 ioctl c0306201 200002c0 returned -14
[  979.222508] binder: undelivered TRANSACTION_ERROR: 29189
[  979.272189] binder_alloc: 18459: binder_alloc_buf, no vma
[  979.272234] binder: 18459:18462 transaction failed 29189/-3, size 24-8 line 3137
[  979.272409] binder: 18459:18462 Release 1 refcount change on invalid ref 1 ret -22
[  979.272416] binder: 18459:18462 unknown command -1073488791
[  979.272424] binder: 18459:18462 ioctl c0306201 20000380 returned -22
[  979.272639] binder: undelivered TRANSACTION_ERROR: 29189
[  979.361018] binder_alloc: 18474: binder_alloc_buf, no vma
[  979.361064] binder: 18474:18480 transaction failed 29189/-3, size 24-8 line 3137
[  979.361173] binder: 18474:18480 ioctl c0306201 200002c0 returned -14
[  979.361306] binder: undelivered TRANSACTION_ERROR: 29189
[  979.411399] binder_alloc: 18479: binder_alloc_buf, no vma
[  979.412614] binder: 18479:18484 transaction failed 29189/-3, size 24-8 line 3137
[  979.412789] binder: 18479:18484 Release 1 refcount change on invalid ref 1 ret -22
[  979.412796] binder: 18479:18484 unknown command -1073488791
[  979.412804] binder: 18479:18484 ioctl c0306201 20000380 returned -22
[  979.412938] binder: undelivered TRANSACTION_ERROR: 29189
[  979.471540] binder_alloc: 18491: binder_alloc_buf, no vma
[  979.471586] binder: 18491:18493 transaction failed 29189/-3, size 24-8 line 3137
[  979.471675] binder: 18491:18493 ioctl c0306201 200002c0 returned -14
[  979.471821] binder: undelivered TRANSACTION_ERROR: 29189
[  979.537294] binder_alloc: 18502: binder_alloc_buf, no vma
[  979.537348] binder: 18502:18507 transaction failed 29189/-3, size 24-8 line 3137
[  979.537533] binder: 18502:18507 Release 1 refcount change on invalid ref 1 ret -22
[  979.537539] binder: 18502:18507 unknown command -1073488791
[  979.537547] binder: 18502:18507 ioctl c0306201 20000380 returned -22
[  979.537694] binder: undelivered TRANSACTION_ERROR: 29189
[  979.590709] binder_alloc: 18510: binder_alloc_buf, no vma
[  979.590755] binder: 18510:18511 transaction failed 29189/-3, size 24-8 line 3137
[  979.590859] binder: 18510:18511 ioctl c0306201 200002c0 returned -14
[  979.591011] binder: undelivered TRANSACTION_ERROR: 29189
[  979.663362] binder_alloc: 18519: binder_alloc_buf, no vma
[  979.663411] binder: 18519:18522 transaction failed 29189/-3, size 24-8 line 3137
[  979.664849] binder: 18519:18522 Release 1 refcount change on invalid ref 1 ret -22
[  979.664856] binder: 18519:18522 unknown command -1073488791
[  979.664865] binder: 18519:18522 ioctl c0306201 20000380 returned -22
[  979.664997] binder: undelivered TRANSACTION_ERROR: 29189
[  979.725787] binder_alloc: 18529: binder_alloc_buf, no vma
[  979.725833] binder: 18529:18530 transaction failed 29189/-3, size 24-8 line 3137
[  979.725920] binder: 18529:18530 ioctl c0306201 200002c0 returned -14
[  979.726069] binder: undelivered TRANSACTION_ERROR: 29189
[  979.826159] binder_alloc: 18540: binder_alloc_buf, no vma
[  979.826203] binder: 18540:18543 transaction failed 29189/-3, size 24-8 line 3137
[  979.828058] binder: 18540:18543 Release 1 refcount change on invalid ref 1 ret -22
[  979.828065] binder: 18540:18543 unknown command -1073488791
[  979.828073] binder: 18540:18543 ioctl c0306201 20000380 returned -22
[  979.828218] binder: undelivered TRANSACTION_ERROR: 29189
[  979.891877] binder_alloc: 18549: binder_alloc_buf, no vma
[  979.892147] binder: 18549:18556 transaction failed 29189/-3, size 24-8 line 3137
[  979.909495] binder: 18549:18556 ioctl c0306201 200002c0 returned -14
[  979.909671] binder: undelivered TRANSACTION_ERROR: 29189
[  979.953041] binder_alloc: 18561: binder_alloc_buf, no vma
[  979.953088] binder: 18561:18563 transaction failed 29189/-3, size 24-8 line 3137
[  979.953242] binder: 18561:18563 Release 1 refcount change on invalid ref 1 ret -22
[  979.953248] binder: 18561:18563 unknown command -1073488791
[  979.953256] binder: 18561:18563 ioctl c0306201 20000380 returned -22
[  979.953404] binder: undelivered TRANSACTION_ERROR: 29189
[  980.005579] binder_alloc: 18566: binder_alloc_buf, no vma
[  980.007078] binder: 18566:18573 transaction failed 29189/-3, size 24-8 line 3137
[  980.007177] binder: 18566:18573 ioctl c0306201 200002c0 returned -14
[  980.007318] binder: undelivered TRANSACTION_ERROR: 29189
[  980.099700] binder_alloc: 18577: binder_alloc_buf, no vma
[  980.099747] binder: 18577:18581 transaction failed 29189/-3, size 24-8 line 3137
[  980.099930] binder: 18577:18581 Release 1 refcount change on invalid ref 1 ret -22
[  980.099937] binder: 18577:18581 unknown command -1073488791
[  980.099945] binder: 18577:18581 ioctl c0306201 20000380 returned -22
[  980.100093] binder: undelivered TRANSACTION_ERROR: 29189
[  980.129016] binder_alloc: 18584: binder_alloc_buf, no vma
[  980.129062] binder: 18584:18592 transaction failed 29189/-3, size 24-8 line 3137
[  980.129996] binder: 18584:18592 ioctl c0306201 200002c0 returned -14
[  980.130712] binder: undelivered TRANSACTION_ERROR: 29189
[  980.207932] binder_alloc: 18596: binder_alloc_buf, no vma
[  980.207978] binder: 18596:18599 transaction failed 29189/-3, size 24-8 line 3137
[  980.208134] binder: 18596:18599 Release 1 refcount change on invalid ref 1 ret -22
[  980.208141] binder: 18596:18599 unknown command -1073488791
[  980.208150] binder: 18596:18599 ioctl c0306201 20000380 returned -22
[  980.216586] binder: undelivered TRANSACTION_ERROR: 29189
[  980.278659] binder_alloc: 18601: binder_alloc_buf, no vma
[  980.278705] binder: 18601:18609 transaction failed 29189/-3, size 24-8 line 3137
[  980.278796] binder: 18601:18609 ioctl c0306201 200002c0 returned -14
[  980.278936] binder: undelivered TRANSACTION_ERROR: 29189
[  980.303850] binder_alloc: 18611: binder_alloc_buf, no vma
[  980.303897] binder: 18611:18615 transaction failed 29189/-3, size 24-8 line 3137
[  980.307782] binder: 18611:18615 Release 1 refcount change on invalid ref 1 ret -22
[  980.307788] binder: 18611:18615 unknown command -1073488791
[  980.307796] binder: 18611:18615 ioctl c0306201 20000380 returned -22
[  980.307940] binder: undelivered TRANSACTION_ERROR: 29189
[  980.405029] binder_alloc: 18624: binder_alloc_buf, no vma
[  980.405075] binder: 18624:18630 transaction failed 29189/-3, size 24-8 line 3137
[  980.405172] binder: 18624:18630 ioctl c0306201 200002c0 returned -14
[  980.406881] binder: undelivered TRANSACTION_ERROR: 29189
[  980.409218] binder_alloc: 18623: binder_alloc_buf, no vma
[  980.409262] binder: 18623:18631 transaction failed 29189/-3, size 24-8 line 3137
[  980.409442] binder: 18623:18631 Release 1 refcount change on invalid ref 1 ret -22
[  980.409448] binder: 18623:18631 unknown command -1073488791
[  980.409456] binder: 18623:18631 ioctl c0306201 20000380 returned -22
[  980.409739] binder: undelivered TRANSACTION_ERROR: 29189
[  980.523885] binder_alloc: 18643: binder_alloc_buf, no vma
[  980.523931] binder: 18643:18645 transaction failed 29189/-3, size 24-8 line 3137
[  980.524825] binder: 18643:18645 ioctl c0306201 200002c0 returned -14
[  980.525053] binder: undelivered TRANSACTION_ERROR: 29189
[  980.543519] binder_alloc: 18650: binder_alloc_buf, no vma
[  980.543563] binder: 18650:18652 transaction failed 29189/-3, size 24-8 line 3137
[  980.551110] binder: 18650:18652 Release 1 refcount change on invalid ref 1 ret -22
[  980.551117] binder: 18650:18652 unknown command -1073488791
[  980.551133] binder: 18650:18652 ioctl c0306201 20000380 returned -22
[  980.551284] binder: undelivered TRANSACTION_ERROR: 29189
[  980.648375] binder_alloc: 18662: binder_alloc_buf, no vma
[  980.648423] binder: 18662:18666 transaction failed 29189/-3, size 24-8 line 3137
[  980.650614] binder: 18662:18666 ioctl c0306201 200002c0 returned -14
[  980.650861] binder: undelivered TRANSACTION_ERROR: 29189
[  980.672101] binder_alloc: 18663: binder_alloc_buf, no vma
[  980.673366] binder: 18663:18668 transaction failed 29189/-3, size 24-8 line 3137
[  980.673543] binder: 18663:18668 Release 1 refcount change on invalid ref 1 ret -22
[  980.673549] binder: 18663:18668 unknown command -1073488791
[  980.673557] binder: 18663:18668 ioctl c0306201 20000380 returned -22
[  980.682174] binder: undelivered TRANSACTION_ERROR: 29189
[  980.775909] binder_alloc: 18677: binder_alloc_buf, no vma
[  980.775955] binder: 18677:18680 transaction failed 29189/-3, size 24-8 line 3137
[  980.776044] binder: 18677:18680 ioctl c0306201 200002c0 returned -14
[  980.776336] binder: undelivered TRANSACTION_ERROR: 29189
[  980.795011] binder_alloc: 18682: binder_alloc_buf, no vma
[  980.795057] binder: 18682:18687 transaction failed 29189/-3, size 24-8 line 3137
[  980.795232] binder: 18682:18687 Release 1 refcount change on invalid ref 1 ret -22
[  980.795238] binder: 18682:18687 unknown command -1073488791
[  980.795246] binder: 18682:18687 ioctl c0306201 20000380 returned -22
[  980.795403] binder: undelivered TRANSACTION_ERROR: 29189
[  980.889850] binder_alloc: 18696: binder_alloc_buf, no vma
[  980.889899] binder: 18696:18697 transaction failed 29189/-3, size 24-8 line 3137
[  980.890029] binder: 18696:18697 ioctl c0306201 200002c0 returned -14
[  980.890183] binder: undelivered TRANSACTION_ERROR: 29189
[  980.915546] binder_alloc: 18700: binder_alloc_buf, no vma
[  980.915593] binder: 18700:18703 transaction failed 29189/-3, size 24-8 line 3137
[  980.918008] binder: 18700:18703 Release 1 refcount change on invalid ref 1 ret -22
[  980.918015] binder: 18700:18703 unknown command -1073488791
[  980.918023] binder: 18700:18703 ioctl c0306201 20000380 returned -22
[  980.918164] binder: undelivered TRANSACTION_ERROR: 29189
[  981.011714] binder_alloc: 18714: binder_alloc_buf, no vma
[  981.011760] binder: 18714:18716 transaction failed 29189/-3, size 24-8 line 3137
[  981.017429] binder: 18714:18716 ioctl c0306201 200002c0 returned -14
[  981.017588] binder: undelivered TRANSACTION_ERROR: 29189
[  981.072698] binder_alloc: 18723: binder_alloc_buf, no vma
[  981.072744] binder: 18723:18725 transaction failed 29189/-3, size 24-8 line 3137
[  981.072923] binder: 18723:18725 Release 1 refcount change on invalid ref 1 ret -22
[  981.072929] binder: 18723:18725 unknown command -1073488791
[  981.072937] binder: 18723:18725 ioctl c0306201 20000380 returned -22
[  981.073098] binder: undelivered TRANSACTION_ERROR: 29189
[  981.176366] binder_alloc: 18736: binder_alloc_buf, no vma
[  981.176483] binder: 18736:18739 transaction failed 29189/-3, size 24-8 line 3137
[  981.176598] binder: 18736:18739 ioctl c0306201 200002c0 returned -14
[  981.176749] binder: undelivered TRANSACTION_ERROR: 29189
[  981.206695] binder_alloc: 18741: binder_alloc_buf, no vma
[  981.206732] binder: 18741:18744 transaction failed 29189/-3, size 24-8 line 3137
[  981.207276] binder: 18741:18744 Release 1 refcount change on invalid ref 1 ret -22
[  981.207283] binder: 18741:18744 unknown command -1073488791
[  981.207292] binder: 18741:18744 ioctl c0306201 20000380 returned -22
[  981.207677] binder: undelivered TRANSACTION_ERROR: 29189
[  981.299131] binder_alloc: 18752: binder_alloc_buf, no vma
[  981.299177] binder: 18752:18756 transaction failed 29189/-3, size 24-8 line 3137
[  981.299278] binder: 18752:18756 ioctl c0306201 200002c0 returned -14
[  981.302730] binder: undelivered TRANSACTION_ERROR: 29189
[  981.325468] binder_alloc: 18759: binder_alloc_buf, no vma
[  981.325513] binder: 18759:18763 transaction failed 29189/-3, size 24-8 line 3137
[  981.335707] binder: 18759:18763 Release 1 refcount change on invalid ref 1 ret -22
[  981.335715] binder: 18759:18763 unknown command -1073488791
[  981.335724] binder: 18759:18763 ioctl c0306201 20000380 returned -22
[  981.337405] binder: undelivered TRANSACTION_ERROR: 29189
[  981.438286] binder_alloc: 18772: binder_alloc_buf, no vma
[  981.438332] binder: 18772:18775 transaction failed 29189/-3, size 24-8 line 3137
[  981.439235] binder: 18772:18775 ioctl c0306201 200002c0 returned -14
[  981.439368] binder: undelivered TRANSACTION_ERROR: 29189
[  981.450641] binder_alloc: 18776: binder_alloc_buf, no vma
[  981.450686] binder: 18776:18780 transaction failed 29189/-3, size 24-8 line 3137
[  981.450874] binder: 18776:18780 Release 1 refcount change on invalid ref 1 ret -22
[  981.450881] binder: 18776:18780 unknown command -1073488791
[  981.450890] binder: 18776:18780 ioctl c0306201 20000380 returned -22
[  981.451040] binder: undelivered TRANSACTION_ERROR: 29189
[  981.566754] INFO: task init:29331 blocked for more than 140 seconds.
[  981.566760]       Not tainted 4.4.174+ #17
[  981.566762] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  981.566784] init            D ffff8800ba58f718 29280 29331      1 0x00000000
[  981.566795]  ffff8800ba58f718 ffff8801bd4b0000 a4a1846af454e943 ffff8801bd4b0000
[  981.566804]  0000000000000000 ffff8801bd4b0800 ffff8801db71f180 ffff8801db71f1a8
[  981.566813]  ffff8801db71e898 ffff8801bd4b5f00 ffff8801bd4b0000 ffffed00174b1001
[  981.566815] Call Trace:
[  981.566830]  [<ffffffff82709b79>] schedule+0x99/0x1d0
[  981.566838]  [<ffffffff8270a333>] schedule_preempt_disabled+0x13/0x20
[  981.566846]  [<ffffffff8270c492>] mutex_lock_nested+0x3c2/0xb80
[  981.566856]  [<ffffffff81c8b2aa>] ? tty_open+0x56a/0xf50
[  981.566864]  [<ffffffff81b0ab03>] ? assoc_array_gc+0x1233/0x12e0
[  981.566871]  [<ffffffff8270c0d0>] ? mutex_trylock+0x500/0x500
[  981.566879]  [<ffffffff814801a3>] ? kmem_cache_alloc_trace+0x123/0x2d0
[  981.566887]  [<ffffffff81c8b2aa>] tty_open+0x56a/0xf50
[  981.566895]  [<ffffffff81c8ad40>] ? tty_init_dev+0x420/0x420
[  981.566904]  [<ffffffff814a3d5a>] ? chrdev_open+0xca/0x630
[  981.566912]  [<ffffffff81c8ad40>] ? tty_init_dev+0x420/0x420
[  981.566919]  [<ffffffff814a3ec0>] chrdev_open+0x230/0x630
[  981.566927]  [<ffffffff814a3c90>] ? cdev_put.part.0+0x50/0x50
[  981.566937]  [<ffffffff8149154f>] do_dentry_open+0x38f/0xbd0
[  981.566944]  [<ffffffff814b6d8e>] ? __inode_permission2+0x9e/0x250
[  981.566951]  [<ffffffff814a3c90>] ? cdev_put.part.0+0x50/0x50
[  981.566959]  [<ffffffff81494d3b>] vfs_open+0x10b/0x210
[  981.566966]  [<ffffffff814c4947>] ? may_open.isra.0+0xe7/0x210
[  981.566973]  [<ffffffff814c5ddf>] path_openat+0x136f/0x4470
[  981.566981]  [<ffffffff81483f86>] ? kasan_kmalloc.part.0+0xc6/0xf0
[  981.566989]  [<ffffffff814c4a70>] ? may_open.isra.0+0x210/0x210
[  981.566998]  [<ffffffff811ff5b0>] ? trace_hardirqs_on+0x10/0x10
[  981.567006]  [<ffffffff814ccab1>] do_filp_open+0x1a1/0x270
[  981.567014]  [<ffffffff814ca46c>] ? getname_flags+0xcc/0x550
[  981.567022]  [<ffffffff814cc910>] ? user_path_mountpoint_at+0x50/0x50
[  981.567031]  [<ffffffff814f32ea>] ? __alloc_fd+0x1ea/0x490
[  981.567037]  [<ffffffff82717f6d>] ? _raw_spin_unlock+0x2d/0x50
[  981.567044]  [<ffffffff81495668>] do_sys_open+0x2f8/0x600
[  981.567050]  [<ffffffff81495370>] ? filp_open+0x70/0x70
[  981.567057]  [<ffffffff811ff385>] ? trace_hardirqs_on_caller+0x385/0x5a0
[  981.567064]  [<ffffffff8149599d>] SyS_open+0x2d/0x40
[  981.567072]  [<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
[  981.567078] 1 lock held by init/29331:
[  981.567096]  #0:  (tty_mutex){+.+.+.}, at: [<ffffffff81c8b2aa>] tty_open+0x56a/0xf50
[  981.567100] Sending NMI to all CPUs:
[  981.568395] NMI backtrace for cpu 0
[  981.568399] CPU: 0 PID: 20 Comm: khungtaskd Not tainted 4.4.174+ #17
[  981.568402] task: ffff8801da6f2f80 task.stack: ffff8801d9ef0000
[  981.568406] RIP: 0010:[<ffffffff8109b617>]  [<ffffffff8109b617>] flat_send_IPI_mask+0xf7/0x1b0
[  981.568409] RSP: 0018:ffff8801d9ef7c88  EFLAGS: 00000046
[  981.568413] RAX: 0000000000000000 RBX: 0000000000000c00 RCX: 0000000000000000
[  981.568416] RDX: 0000000000000c00 RSI: 0000000000000000 RDI: ffffffffff5fc300
[  981.568419] RBP: ffff8801d9ef7cb8 R08: 0000000000000018 R09: 0000000000000000
[  981.568423] R10: 0000000000000001 R11: 0000000000000001 R12: 0000000000000246
[  981.568426] R13: 0000000003000000 R14: ffffffff82e5f2e0 R15: 0000000000000002
[  981.568430] FS:  0000000000000000(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
[  981.568433] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  981.568437] CR2: 0000000008148008 CR3: 00000000a79ca000 CR4: 00000000001606b0
[  981.568440] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  981.568444] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  981.568445] Stack:
[  981.568448]  0000000000000001 ffffffff82e5f2e0 ffffffff831a6ac0 fffffbfff0634c34
[  981.568452]  000000000001b6c0 0000000000000008 ffff8801d9ef7cd8 ffffffff81092bee
[  981.568456]  0000000000000008 ffffffff82924260 ffff8801d9ef7d30 ffffffff81ab8252
[  981.568458] Call Trace:
[  981.568461]  [<ffffffff81092bee>] nmi_raise_cpu_backtrace+0x5e/0x80
[  981.568465]  [<ffffffff81ab8252>] nmi_trigger_all_cpu_backtrace.cold+0xa1/0xae
[  981.568468]  [<ffffffff813ab1a4>] ? print_lock+0xa8/0xab
[  981.568471]  [<ffffffff81092b90>] ? irq_force_complete_move+0x330/0x330
[  981.568474]  [<ffffffff81092ca4>] arch_trigger_all_cpu_backtrace+0x14/0x20
[  981.568477]  [<ffffffff813b4762>] watchdog.cold+0xd3/0xee
[  981.568479]  [<ffffffff81309bec>] ? watchdog+0xac/0xa00
[  981.568483]  [<ffffffff81309b40>] ? reset_hung_task_detector+0x20/0x20
[  981.568486]  [<ffffffff811342c3>] kthread+0x273/0x310
[  981.568489]  [<ffffffff81134050>] ? kthread_create_on_node+0x4c0/0x4c0
[  981.568492]  [<ffffffff82718079>] ? _raw_spin_unlock_irq+0x39/0x60
[  981.568495]  [<ffffffff81159431>] ? finish_task_switch+0x1e1/0x660
[  981.568499]  [<ffffffff81159403>] ? finish_task_switch+0x1b3/0x660
[  981.568502]  [<ffffffff827081ff>] ? __schedule+0x7af/0x1ee0
[  981.568505]  [<ffffffff827081f3>] ? __schedule+0x7a3/0x1ee0
[  981.568508]  [<ffffffff827081ff>] ? __schedule+0x7af/0x1ee0
[  981.568511]  [<ffffffff81134050>] ? kthread_create_on_node+0x4c0/0x4c0
[  981.568514]  [<ffffffff82718fc5>] ret_from_fork+0x55/0x80
[  981.568517]  [<ffffffff81134050>] ? kthread_create_on_node+0x4c0/0x4c0
[  981.568525] Code: 00 c3 5f ff 80 e6 10 75 e1 41 c1 e5 18 44 89 2c 25 10 c3 5f ff 44 89 fa 09 da 80 cf 04 41 83 ff 02 0f 44 d3 89 14 25 00 c3 5f ff <41> f7 c4 00 02 00 00 75 1e 4c 89 e7 57 9d 0f 1f 44 00 00 e8 f1 
[  981.568527] NMI backtrace for cpu 1
[  981.568531] CPU: 1 PID: 2333 Comm: udevd Not tainted 4.4.174+ #17
[  981.568534] task: ffff8800b93edf00 task.stack: ffff8800b8d88000
[  981.568537] RIP: 0010:[<ffffffff8112f4e0>]  [<ffffffff8112f4e0>] __kernel_text_address+0x0/0xa0
[  981.568540] RSP: 0018:ffff8800b8d8fae8  EFLAGS: 00000287
[  981.568544] RAX: ffff8800b8d8fef8 RBX: ffff8800b8d8fe98 RCX: 0000000000000005
[  981.568547] RDX: ffff8800b8d8fc08 RSI: ffff8800b91b2a60 RDI: ffff8800b91b2a60
[  981.568551] RBP: ffff8800b8d8fb38 R08: ffff8800b8d8fbf0 R09: 0000000000000000
[  981.568554] R10: ffff8800b8d8fef8 R11: 0000000000000000 R12: 0000000000000000
[  981.568558] R13: ffff8800b8d8fbf0 R14: ffff8800b8d8fff8 R15: ffff8800b8d88000
[  981.568562] FS:  00007f7efb8b67a0(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000
[  981.568565] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  981.568568] CR2: 00007f7efb8bd000 CR3: 00000000b8109000 CR4: 00000000001606b0
[  981.568572] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  981.568575] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  981.568577] Stack:
[  981.568580]  ffffffff81013549 ffff8800b91b2a60 ffff8800b8d8fef8 ffff8800b8d8fef8
[  981.568584]  ffffffff8280f0b0 ffff8800b8d8fbf0 ffffffff8280f0b0 ffff8800b8d8fb90
[  981.568588]  ffff8801db707fc0 0000000000000000 ffff8800b8d8fbc8 ffffffff81012bb9
[  981.568590] Call Trace:
[  981.568593]  [<ffffffff81013549>] ? print_context_stack+0x59/0xd0
[  981.568596]  [<ffffffff81012bb9>] dump_trace+0x179/0x390
[  981.568599]  [<ffffffff8102e3c6>] save_stack_trace+0x26/0x50
[  981.568602]  [<ffffffff81484820>] kasan_slab_free+0xb0/0x190
[  981.568605]  [<ffffffff8102e3c6>] ? save_stack_trace+0x26/0x50
[  981.568608]  [<ffffffff81484820>] ? kasan_slab_free+0xb0/0x190
[  981.568611]  [<ffffffff8148157e>] ? kmem_cache_free+0xbe/0x350
[  981.568614]  [<ffffffff81441d82>] ? remove_vma+0x122/0x170
[  981.568617]  [<ffffffff81445692>] ? do_munmap+0x5a2/0xcf0
[  981.568628]  [<ffffffff8123a761>] ? debug_lockdep_rcu_enabled+0x71/0xa0
[  981.568631]  [<ffffffff811fefb1>] ? mark_held_locks+0xb1/0x100
[  981.568634]  [<ffffffff8271802a>] ? _raw_spin_unlock_irqrestore+0x5a/0x70
[  981.568638]  [<ffffffff811ff385>] ? trace_hardirqs_on_caller+0x385/0x5a0
[  981.568641]  [<ffffffff82718015>] ? _raw_spin_unlock_irqrestore+0x45/0x70
[  981.568645]  [<ffffffff81b0d719>] ? debug_check_no_obj_freed+0x2b9/0x6e0
[  981.568648]  [<ffffffff81b0d460>] ? debug_object_active_state+0x380/0x380
[  981.568651]  [<ffffffff811fefb1>] ? mark_held_locks+0xb1/0x100
[  981.568654]  [<ffffffff8148155e>] ? kmem_cache_free+0x9e/0x350
[  981.568657]  [<ffffffff81441d82>] ? remove_vma+0x122/0x170
[  981.568660]  [<ffffffff81441d82>] ? remove_vma+0x122/0x170
[  981.568663]  [<ffffffff8148157e>] kmem_cache_free+0xbe/0x350
[  981.568665]  [<ffffffff81441d82>] remove_vma+0x122/0x170
[  981.568668]  [<ffffffff81445692>] do_munmap+0x5a2/0xcf0
[  981.568670]  [<ffffffff81445e42>] vm_munmap+0x62/0x90
[  981.568673]  [<ffffffff8144b4d6>] SyS_munmap+0x26/0x30
[  981.568676]  [<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
[  981.568683] Code: e7 59 35 00 eb ce 0f 1f 44 00 00 31 c0 48 81 ff 00 00 e0 82 72 0c 31 c0 48 81 ff 40 2a 1b 83 0f 92 c0 c3 0f 1f 84 00 00 00 00 00 <55> 48 81 ff b8 02 00 81 48 89 e5 53 48 89 fb 72 09 48 81 ff c1 
[  981.568786] Kernel panic - not syncing: hung_task: blocked tasks
[  981.568794] CPU: 0 PID: 20 Comm: khungtaskd Not tainted 4.4.174+ #17
[  981.568805]  0000000000000000 f0a8a540a7796467 ffff8801d9ef7c60 ffffffff81aad1a1
[  981.568814]  ffff8801bd4b0000 ffffffff82872120 dffffc0000000000 0000000000000003
[  981.568823]  00000000003fff5a ffff8801d9ef7d40 ffffffff813a48c2 0000000041b58ab3
[  981.568825] Call Trace:
[  981.568834]  [<ffffffff81aad1a1>] dump_stack+0xc1/0x120
[  981.568844]  [<ffffffff813a48c2>] panic+0x1b9/0x37b
[  981.568852]  [<ffffffff813a4709>] ? add_taint.cold+0x16/0x16
[  981.568860]  [<ffffffff81af10f4>] ? find_next_bit+0x44/0x50
[  981.568869]  [<ffffffff81ab8046>] ? nmi_trigger_all_cpu_backtrace+0x3c6/0x490
[  981.568878]  [<ffffffff81ab8046>] ? nmi_trigger_all_cpu_backtrace+0x3c6/0x490
[  981.568885]  [<ffffffff813b4773>] watchdog.cold+0xe4/0xee
[  981.568892]  [<ffffffff81309bec>] ? watchdog+0xac/0xa00
[  981.568900]  [<ffffffff81309b40>] ? reset_hung_task_detector+0x20/0x20
[  981.568908]  [<ffffffff811342c3>] kthread+0x273/0x310
[  981.568916]  [<ffffffff81134050>] ? kthread_create_on_node+0x4c0/0x4c0
[  981.568924]  [<ffffffff82718079>] ? _raw_spin_unlock_irq+0x39/0x60
[  981.568932]  [<ffffffff81159431>] ? finish_task_switch+0x1e1/0x660
[  981.568939]  [<ffffffff81159403>] ? finish_task_switch+0x1b3/0x660
[  981.568946]  [<ffffffff827081ff>] ? __schedule+0x7af/0x1ee0
[  981.568953]  [<ffffffff827081f3>] ? __schedule+0x7a3/0x1ee0
[  981.568961]  [<ffffffff827081ff>] ? __schedule+0x7af/0x1ee0
[  981.568969]  [<ffffffff81134050>] ? kthread_create_on_node+0x4c0/0x4c0
[  981.568976]  [<ffffffff82718fc5>] ret_from_fork+0x55/0x80
[  981.568984]  [<ffffffff81134050>] ? kthread_create_on_node+0x4c0/0x4c0
[  981.569369] Kernel Offset: disabled
[  993.212286] Rebooting in 86400 seconds..