x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:14 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:03:14 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x6000000)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:15 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:15 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00]}, 0x2c)

14:03:15 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:15 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x7000000)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:15 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:03:15 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000000000]})

[ 1706.497125] binder: release 10990:10991 transaction 186 out, still active
[ 1706.504379] binder: undelivered TRANSACTION_COMPLETE
[ 1706.522304] binder: send failed reply for transaction 186, target dead
14:03:15 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00]}, 0x2c)

14:03:15 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d564b00000000]})

14:03:15 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x8000000)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:15 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:15 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}, 0x2c)

14:03:15 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x0}, 0x0)

[ 1706.748564] binder: BINDER_SET_CONTEXT_MGR already set
[ 1706.777886] binder: 11049:11050 ioctl 40046207 0 returned -16
14:03:16 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:16 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00]}, 0x2c)

14:03:16 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x9000000)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:16 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:03:16 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]})

[ 1707.362994] binder: release 11024:11036 transaction 189 out, still active
[ 1707.372414] binder: undelivered TRANSACTION_COMPLETE
[ 1707.382332] binder: send failed reply for transaction 189, target dead
[ 1707.389076] binder: send failed reply for transaction 191 to 11049:11050
14:03:16 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1707.449726] binder: undelivered TRANSACTION_COMPLETE
[ 1707.454870] binder: undelivered TRANSACTION_ERROR: 29189
14:03:16 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1100]}, 0x2c)

14:03:16 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:03:16 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0xa000000)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:16 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]})

[ 1707.536761] binder: BINDER_SET_CONTEXT_MGR already set
[ 1707.555787] binder: 11076:11077 ioctl 40046207 0 returned -16
[ 1707.604103] binder: 11077 RLIMIT_NICE not set
14:03:16 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1200]}, 0x2c)

[ 1707.625130] binder: release 11076:11086 transaction 196 out, still active
14:03:16 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1707.763787] binder: BINDER_SET_CONTEXT_MGR already set
[ 1707.772318] binder: 11097:11098 ioctl 40046207 0 returned -16
14:03:17 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0xb000000)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:17 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:03:17 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10100c000000000]})

14:03:17 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:17 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1300]}, 0x2c)

[ 1708.237617] binder: release 11071:11072 transaction 194 out, still active
[ 1708.244777] binder_release_work: 1 callbacks suppressed
[ 1708.244782] binder: undelivered TRANSACTION_COMPLETE
[ 1708.260818] binder: send failed reply for transaction 194, target dead
[ 1708.267597] binder: send failed reply for transaction 196, target dead
14:03:17 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1400]}, 0x2c)

[ 1708.325975] binder: send failed reply for transaction 198 to 11097:11098
[ 1708.339872] binder: undelivered TRANSACTION_COMPLETE
14:03:17 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:17 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0xc000000)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

[ 1708.368750] binder: undelivered TRANSACTION_ERROR: 29189
14:03:17 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14d564b00000000]})

14:03:17 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:03:17 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1500]}, 0x2c)

14:03:17 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x3b9ac9ff)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:17 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1800]}, 0x2c)

14:03:17 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:03:17 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]})

14:03:18 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:18 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00]}, 0x2c)

14:03:18 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x3f000000)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

[ 1709.099704] binder: release 11107:11111 transaction 201 out, still active
[ 1709.106812] binder: undelivered TRANSACTION_COMPLETE
[ 1709.118864] binder: send failed reply for transaction 201, target dead
[ 1709.127375] binder: send failed reply for transaction 203 to 11120:11121
14:03:18 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:18 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:03:18 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20100c000000000]})

14:03:18 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}, 0x2c)

[ 1709.210128] binder: undelivered TRANSACTION_COMPLETE
[ 1709.215362] binder: undelivered TRANSACTION_ERROR: 29189
14:03:18 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0xffc99a3b)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

[ 1709.256890] binder: 11167 RLIMIT_NICE not set
14:03:18 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000]}, 0x2c)

14:03:18 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:18 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:03:18 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24d564b00000000]})

[ 1709.426301] binder: 11181 RLIMIT_NICE not set
14:03:19 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:19 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x100000000000000)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:19 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff]}, 0x2c)

14:03:19 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:19 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30001c000000000]})

14:03:19 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x0}, 0x0)

[ 1709.999969] binder: release 11158:11159 transaction 206 out, still active
[ 1710.006975] binder: undelivered TRANSACTION_COMPLETE
[ 1710.017080] binder: send failed reply for transaction 206, target dead
[ 1710.065134] binder: 11195:11204 Acquire 1 refcount change on invalid ref 0 ret -22
14:03:19 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}, 0x2c)

14:03:19 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x300000000000000)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

[ 1710.131776] binder: 11204 RLIMIT_NICE not set
14:03:19 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:03:19 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:19 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:19 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30100c000000000]})

14:03:19 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x2c)

14:03:19 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:19 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x400000000000000)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

[ 1710.311469] binder: 11228:11229 ioctl c0306201 0 returned -14
14:03:19 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x0}, 0x0)

[ 1710.364177] binder: 11228:11229 Acquire 1 refcount change on invalid ref 0 ret -22
[ 1710.399819] binder: 11229 RLIMIT_NICE not set
14:03:19 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}, 0x2c)

14:03:19 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x34d564b00000000]})

14:03:19 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:19 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x500000000000000)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:19 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x0}, 0x0)

[ 1710.563385] binder_alloc: 11250: binder_alloc_buf, no vma
[ 1710.594233] binder: 11250:11252 transaction failed 29189/-3, size 0-0 line 3035
14:03:19 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000]}, 0x2c)

[ 1710.628664] binder: undelivered TRANSACTION_ERROR: 29189
14:03:20 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:20 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x600000000000000)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:20 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000]}, 0x2c)

14:03:20 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40001c000000000]})

14:03:20 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:20 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:03:20 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000]}, 0x2c)

[ 1711.185068] binder_alloc: 11270: binder_alloc_buf, no vma
[ 1711.196859] binder: 11279:11280 ioctl c0306201 0 returned -14
[ 1711.218222] binder: 11270:11271 transaction failed 29189/-3, size 0-0 line 3035
[ 1711.221472] binder: 11280 RLIMIT_NICE not set
14:03:20 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x700000000000000)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

[ 1711.264656] binder: 11283 RLIMIT_NICE not set
[ 1711.284694] binder: undelivered TRANSACTION_ERROR: 29189
14:03:20 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:03:20 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000]}, 0x2c)

14:03:20 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44d564b00000000]})

14:03:20 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1711.463222] binder_alloc: 11301: binder_alloc_buf, no vma
[ 1711.481929] binder: 11301:11303 transaction failed 29189/-3, size 0-0 line 3035
[ 1711.513025] binder: 11306 RLIMIT_NICE not set
[ 1711.546304] binder: undelivered TRANSACTION_ERROR: 29189
14:03:21 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:21 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x800000000000000)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:21 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000]}, 0x2c)

14:03:21 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}, 0x1, 0x0, 0x0, 0x0}, 0x0)

14:03:21 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70001c000000000]})

14:03:21 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:21 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9000000]}, 0x2c)

[ 1712.096191] binder_alloc: 11318: binder_alloc_buf, no vma
[ 1712.110136] binder: 11310:11321 ioctl c0306201 0 returned -14
[ 1712.122912] binder: 11318:11319 transaction failed 29189/-3, size 0-0 line 3035
[ 1712.123643] binder: 11321 RLIMIT_NICE not set
[ 1712.148223] binder: 11324 RLIMIT_NICE not set
[ 1712.180167] binder: undelivered TRANSACTION_ERROR: 29189
14:03:21 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x2)

14:03:21 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x801004000000000]})

14:03:21 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:21 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x900000000000000)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:21 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000]}, 0x2c)

[ 1712.342301] binder_alloc: 11337: binder_alloc_buf, no vma
[ 1712.351291] binder: 11337:11340 transaction failed 29189/-3, size 0-0 line 3035
[ 1712.360343] binder: undelivered TRANSACTION_ERROR: 29189
14:03:21 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:21 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:21 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x4)

14:03:21 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0xa00000000000000)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:21 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb000000]}, 0x2c)

14:03:21 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x803000000000000]})

14:03:22 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc000000]}, 0x2c)

[ 1713.010988] binder_alloc: 11359: binder_alloc_buf, no vma
[ 1713.027306] binder: 11359:11360 transaction failed 29189/-3, size 0-0 line 3035
[ 1713.049765] binder: 11364 RLIMIT_NICE not set
14:03:22 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0xb00000000000000)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:22 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x8)

[ 1713.075000] binder: undelivered TRANSACTION_ERROR: 29189
14:03:22 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa01000000000000]})

14:03:22 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:22 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd000000]}, 0x2c)

[ 1713.231579] binder: 11379:11380 transaction failed 29189/-22, size 0-0 line 2896
[ 1713.277514] binder: undelivered TRANSACTION_ERROR: 29189
14:03:22 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:22 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0xc00000000000000)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:22 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x10)

14:03:22 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:22 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000]})

14:03:22 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}, 0x2c)

14:03:22 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1713.910139] binder: 11392:11393 Acquire 1 refcount change on invalid ref 0 ret -22
[ 1713.918177] binder: 11400:11401 transaction failed 29189/-22, size 0-0 line 2896
[ 1713.929374] binder: undelivered TRANSACTION_ERROR: 29189
[ 1713.943764] binder: 11393 RLIMIT_NICE not set
14:03:23 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf000000]}, 0x2c)

14:03:23 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x3f00000000000000)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:23 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x3f00)

14:03:23 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000]}, 0x2c)

14:03:23 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1100000000000000]})

[ 1714.078601] binder: 11410:11411 transaction failed 29189/-22, size 0-0 line 2896
[ 1714.124123] binder: undelivered TRANSACTION_ERROR: 29189
14:03:23 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:23 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0xffc99a3b00000000)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:23 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11000000]}, 0x2c)

14:03:23 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x34000)

14:03:23 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:23 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1200000000000000]})

14:03:23 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12000000]}, 0x2c)

[ 1714.782969] binder: 11440 RLIMIT_NICE not set
14:03:23 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x150001c000000000]})

14:03:23 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x400300)

14:03:23 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000000)='/dev/cachefiles\x00', 0x400100, 0x0)
ioctl$EVIOCGABS20(r0, 0x80184560, &(0x7f0000000040)=""/24)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:23 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13000000]}, 0x2c)

14:03:23 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:24 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:24 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14000000]}, 0x2c)

14:03:24 executing program 5:
r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x100, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000080)={<r1=>0xffffffffffffffff}, 0x13f, 0x4}}, 0x20)
write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r0, &(0x7f0000000140)={0x10, 0x30, 0xfa00, {&(0x7f0000000040), 0x0, {0xa, 0x4e24, 0x6, @rand_addr="ad037092fd94bd0520fea5f459b8f70c", 0x4}, r1}}, 0x38)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0x81, 0x0, 0x0, 0x0, 0x223)

14:03:24 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x170101c000000000]})

14:03:24 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x1000000)

14:03:24 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1715.671078] binder_set_nice: 2 callbacks suppressed
[ 1715.671086] binder: 11479 RLIMIT_NICE not set
14:03:24 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x15000000]}, 0x2c)

[ 1715.715316] binder: 11483 RLIMIT_NICE not set
14:03:24 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x2000000)

14:03:24 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:24 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1b00000000000000]})

14:03:24 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18000000]}, 0x2c)

[ 1715.858269] binder: 11492:11496 ioctl c0306201 0 returned -14
14:03:24 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x4000000)

[ 1715.915767] binder: 11500 RLIMIT_NICE not set
14:03:25 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:25 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f000000]}, 0x2c)

14:03:25 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:25 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x8000000)

14:03:25 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1b0001c000000000]})

14:03:25 executing program 5:
r0 = openat$ion(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ion\x00', 0x400081, 0x0)
fsetxattr$trusted_overlay_origin(r0, &(0x7f0000000240)='trusted.overlay.origin\x00', &(0x7f0000000280)='y\x00', 0x2, 0x2)
r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x200001, 0x0)
write$apparmor_exec(r2, &(0x7f0000000300)=ANY=[@ANYBLOB="7308f8e1fa2b833af21c29b67461636b20090000000000000023fbd3fd120e7d10fed975770815afaff70b10969e40205de0db5655cd85f6c3602c115a2602a831b7e6fc0e9c2d"], 0xc)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
setsockopt$sock_int(r2, 0x1, 0x28, &(0x7f00000002c0)=0x7, 0x4)
ioctl$NBD_SET_SIZE_BLOCKS(r2, 0xab07, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000000)={0xe000000000000000, 0x848, 0x0, 0xd09, 0x40, 0x5, 0x417b, 0x7, <r3=>0x0}, &(0x7f0000000100)=0x20)
setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000140)={r3, 0x8, 0x5216172d4da7b7cb}, 0xc)

14:03:25 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe4ffffff]}, 0x2c)

[ 1716.613584] binder: 11511:11519 ioctl c0306201 0 returned -14
[ 1716.643030] binder: 11522 RLIMIT_NICE not set
[ 1716.652338] binder: 11519 RLIMIT_NICE not set
14:03:25 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1e01000000000000]})

14:03:25 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x10000000)

14:03:25 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f0000000000)=0x2, 0x85, 0x2, &(0x7f0000000040)={0x77359400}, &(0x7f0000000080)=0x3, 0x0)
r0 = syz_open_dev$vcsa(&(0x7f0000000100)='/dev/vcsa#\x00', 0x2, 0x80000)
r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000200)='IPVS\x00')
sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x44000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="00012dbd7000fbdbdf250e000015080006001003fbff0700060007000000080006000300000001f1000004000000"], 0x34}, 0x1, 0x0, 0x0, 0x20000000}, 0x80)
ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f00000003c0))
futex(&(0x7f0000000300)=0x2, 0x4, 0x2, &(0x7f0000000340), &(0x7f0000000380)=0x1, 0x2)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:25 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000]}, 0x2c)

14:03:25 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffe4]}, 0x2c)

14:03:26 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:26 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000]}, 0x2c)

14:03:26 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f0001c000000000]})

14:03:26 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x3f000000)

14:03:26 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
mlockall(0x1)

14:03:26 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1717.498549] binder: 11561:11563 ioctl c0306201 0 returned -14
[ 1717.534795] binder: 11563 RLIMIT_NICE not set
14:03:26 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000000]}, 0x2c)

[ 1717.547118] binder: 11566 RLIMIT_NICE not set
14:03:26 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x2, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x101000, 0x0)
accept4$packet(r0, &(0x7f0000000100)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000140)=0x14, 0x80800)
setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000200)={@remote, r1}, 0x14)
ioctl$DRM_IOCTL_FREE_BUFS(r0, 0x4010641a, &(0x7f0000000080)={0x6, &(0x7f0000000040)=[0x1, 0x9, 0x7, 0x80000000, 0x6, 0x100000001]})

14:03:26 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0xffffff7f)

14:03:26 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200001c000000000]})

14:03:26 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]}, 0x2c)

14:03:26 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000280)='/dev/vcs\x00', 0x101000, 0x0)
ioctl$KVM_GET_NR_MMU_PAGES(r0, 0xae45, 0x40)
syz_open_dev$midi(&(0x7f00000002c0)='/dev/midi#\x00', 0x5, 0xecede70175049838)
r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x200002, 0x0)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00')
sendmsg$IPVS_CMD_GET_CONFIG(r1, &(0x7f0000000240)={&(0x7f0000000040), 0xc, &(0x7f0000000200)={&(0x7f0000000100)={0x64, r2, 0x10, 0x70bd28, 0x25dfdbfb, {}, [@IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x18000000000}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ip6_vti0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x100000000}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x7}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x3}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x92}]}, 0x64}}, 0x20008841)

14:03:27 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:27 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}, 0x2c)

14:03:27 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x40030000000000)

14:03:27 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x221001c000000000]})

14:03:27 executing program 5:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffff35c4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x4, 0xffffffffffffffff, 0x0)
r1 = request_key(&(0x7f0000000000)='cifs.spnego\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)='.\x00', 0x0)
r2 = request_key(&(0x7f0000000100)='logon\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000200)='\x00', 0xfffffffffffffff9)
ioctl$ASHMEM_SET_NAME(r0, 0x41007701, &(0x7f0000000300)='wlan1&em1//\x00')
keyctl$instantiate(0xc, r1, 0x0, 0x0, r2)
r3 = syz_open_dev$midi(&(0x7f0000000240)='/dev/midi#\x00', 0xbe, 0x8000)
r4 = dup3(r0, r0, 0x80000)
ioctl$KVM_CREATE_DEVICE(r3, 0xc00caee0, &(0x7f0000000280)={0x6, r4, 0x1})
r5 = syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f00000002c0)='ns/pid\x00')
dup3(r5, r4, 0x80000)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:27 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:27 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}, 0x2c)

[ 1718.394503] binder: 11599 RLIMIT_NICE not set
[ 1718.413895] binder: release 11605:11607 transaction 249 out, still active
[ 1718.426234] binder: undelivered TRANSACTION_COMPLETE
14:03:27 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:27 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x100000000000000)

14:03:27 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2a1001c000000000]})

14:03:27 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}, 0x2c)

14:03:27 executing program 5:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0xbf3, 0x101000)
ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f0000000040))
getsockname(r1, &(0x7f0000000200)=@rc, &(0x7f0000000080)=0x80)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
fstat(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0})
ioctl$TUNSETGROUP(r1, 0x400454ce, r2)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

[ 1718.540762] binder: release 11614:11615 transaction 250 out, still active
[ 1718.547787] binder: undelivered TRANSACTION_COMPLETE
14:03:27 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:27 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000]}, 0x2c)

[ 1718.663711] binder: release 11629:11632 transaction 251 out, still active
[ 1718.676206] binder: undelivered TRANSACTION_COMPLETE
14:03:27 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
r0 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0xffffffffffffff00, 0x1)
ioctl$VHOST_SET_LOG_BASE(r0, 0x4008af04, &(0x7f0000000080)=&(0x7f0000000040))

14:03:27 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x200000000000000)

14:03:27 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

[ 1718.846107] binder: 11646:11647 ioctl c0306201 0 returned -14
[ 1718.861367] binder: release 11646:11647 transaction 252 out, still active
[ 1718.877456] binder: undelivered TRANSACTION_COMPLETE
14:03:28 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:28 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2c1001c000000000]})

14:03:28 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000]}, 0x2c)

14:03:28 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8, 0x77a0000000}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:28 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x400000000000000)

14:03:28 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

[ 1719.232581] binder: send failed reply for transaction 249, target dead
[ 1719.267294] binder: send failed reply for transaction 250, target dead
14:03:28 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000]}, 0x2c)

[ 1719.286394] binder: send failed reply for transaction 251, target dead
[ 1719.293318] binder: 11657:11661 transaction failed 29189/-22, size 0-0 line 2896
[ 1719.308853] binder: send failed reply for transaction 252, target dead
[ 1719.318014] binder: 11664 RLIMIT_NICE not set
[ 1719.333153] binder: 11657:11661 ioctl c0306201 0 returned -14
14:03:28 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
r0 = syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x1b, 0x200)
ioctl$BLKDISCARD(r0, 0x1277, &(0x7f0000000040)=0xfffffffffffffff8)

14:03:28 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x800000000000000)

[ 1719.364015] binder: undelivered TRANSACTION_ERROR: 29189
14:03:28 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3400000000000000]})

14:03:28 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

14:03:28 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000]}, 0x2c)

[ 1719.503435] binder: 11681:11684 ioctl c0306201 0 returned -14
[ 1719.546997] binder: release 11681:11684 transaction 256 out, still active
[ 1719.558801] binder: undelivered TRANSACTION_COMPLETE
14:03:29 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:29 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
pipe2(&(0x7f0000000000)={<r0=>0xffffffffffffffff}, 0x4000)
ioctl$VIDIOC_S_PARM(r0, 0xc0cc5616, &(0x7f0000000200)={0x5, @raw_data="c7cbdd1dc581f5dc50eddb3b521fe252dbcfe1359f55fe42ed33fc52ae4f15befc0ee456c43d5baa32e70331467efb1f8fc355f108a8b7150f53281e7ac804078899af7296e5a74e53c61d55c0e735a4691045581a6d68e8175d6d29eccb038fb24598a67ba22cdef8fda6c2da6b9edcdbba7760dfff2aac0f20d54b0c948b6b526a6d8644e9c6ff2ace8a7169dc6d3f0c9c130e943c16c84612bf80f551627007da7e7818358930aa0441090c4d0955db22b36cdd8e69735b06eca9b2d3703c68e1e4677e6f3902"})

14:03:29 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000]}, 0x2c)

14:03:29 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:29 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x1000000000000000)

14:03:29 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a00000000000000]})

[ 1720.142406] binder: send failed reply for transaction 256, target dead
[ 1720.172576] binder: 11695:11696 transaction failed 29189/-22, size 0-0 line 2896
[ 1720.212468] binder: 11702 RLIMIT_NICE not set
14:03:29 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, 0x2c)

[ 1720.239879] binder: undelivered TRANSACTION_ERROR: 29189
14:03:29 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:29 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3b00000000000000]})

14:03:29 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x4000, 0x0)
ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000040)=0x1)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:29 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x3f00000000000000)

14:03:29 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000]}, 0x2c)

14:03:30 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:30 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
io_setup(0x0, &(0x7f0000000000)=<r0=>0x0)
io_pgetevents(r0, 0x3f, 0x4, &(0x7f0000000040)=[{}, {}, {}, {}], &(0x7f0000000100), &(0x7f0000000200)={&(0x7f0000000140)={0x9}, 0x8})
r1 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffff8)
r2 = add_key$keyring(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffb)
keyctl$link(0x8, r1, r2)

14:03:30 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]})

14:03:30 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00000000000000]}, 0x2c)

14:03:30 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0xffffff7f00000000)

[ 1721.007974] binder: send failed reply for transaction 260 to 11715:11716
14:03:30 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00000000000000]}, 0x2c)

14:03:30 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1721.090411] binder: undelivered TRANSACTION_COMPLETE
[ 1721.090586] binder: 11742 RLIMIT_NICE not set
[ 1721.098599] binder: undelivered TRANSACTION_ERROR: 29189
14:03:30 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000000)=0xe8)
setsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000080)={r1, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0xc)
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:30 executing program 5:
openat$ion(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ion\x00', 0x200, 0x0)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x2, 0x0, 0x0, 0x223)

14:03:30 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001000000000000]})

14:03:30 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00000000000000]}, 0x2c)

14:03:30 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}, 0x2c)

14:03:30 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:30 executing program 3:
r0 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
getsockname$packet(r0, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000080)=0x14)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB="021600000a00000000000000e52c00000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe80000000000000000000000200000062c4a5f39f42ebd6b6fd36b3c330ad9d362fc8ec60252f81b72d105d07e6e4dd86bb61bc6a1b1b04dd391a8fb3964f6031f7405c1d50294993804da674ea5d6f1477479973a4226860c962d33f068ff0ea51085f472f629782735f3a172451bce627c5c67310a2e734c0d3d33af6bb5e9d4cd33a1a91d5bd423a348d11cd2280e0c9a0bd5f43bc20604260894e86329e4c60fab6bb9f1fdb8b18038cd8ceaab2ab18ba5a7084d4cbe829fb75eab9d21ffd1503baa9c9679735ea36b0468b0e7b429485bffccdabf03d004458338641"], 0x50}}, 0x0)

14:03:30 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400101c000000000]})

14:03:30 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00000000000000]}, 0x2c)

14:03:30 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x7fff, 0x0)
ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)

[ 1721.875299] binder: send failed reply for transaction 263 to 11750:11751
14:03:30 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1721.930807] binder: undelivered TRANSACTION_COMPLETE
[ 1721.936007] binder: undelivered TRANSACTION_ERROR: 29189
[ 1721.960721] binder: 11783 RLIMIT_NICE not set
14:03:31 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000]}, 0x2c)

14:03:31 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
socket$rds(0x15, 0x5, 0x0)
r0 = semget(0x0, 0x0, 0x400)
semctl$IPC_RMID(r0, 0x0, 0x0)
futex(&(0x7f0000000080), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:31 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x410101c000000000]})

14:03:31 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$BLKTRACESTART(r1, 0x1274, 0x0)
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:31 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1100000000000000]}, 0x2c)

14:03:31 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4800000000000000]})

14:03:31 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:31 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1200000000000000]}, 0x2c)

14:03:31 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
ioctl$int_out(r1, 0x2, &(0x7f00000003c0))
r2 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x0, 0x2)
getsockopt$inet_sctp_SCTP_PEER_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1a, &(0x7f0000000080)={<r3=>0x0, 0x55, "2c46f21b2d263b7ce1e1639ec8b22453d0aeeed024e8924b2616d7e2e9fc7b75e760601d65789feefbc345f1fc8ba0d46ab9ea66325d40a871aafa3cab181c72395a153ed8f1bfe345d1d30306e0d2a20864469748"}, &(0x7f0000000100)=0x5d)
getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f00000001c0)={<r4=>0x0, 0xf2e}, &(0x7f0000000200)=0x8)
getsockopt$inet_sctp6_SCTP_STATUS(r2, 0x84, 0xe, &(0x7f00000002c0)={r3, 0x4, 0x200, 0x100000000, 0x6, 0xfa3, 0x8e, 0x80000001, {r4, @in6={{0xa, 0x4e23, 0x4, @dev={0xfe, 0x80, [], 0x1f}, 0xffffffffffff0001}}, 0x6, 0x0, 0x1f, 0x5, 0x3}}, &(0x7f0000000380)=0xb0)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:31 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4900000000000000]})

[ 1722.731154] binder: send failed reply for transaction 266 to 11787:11788
14:03:31 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000), 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:31 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1300000000000000]}, 0x2c)

[ 1722.799928] binder: undelivered TRANSACTION_COMPLETE
[ 1722.805550] binder: undelivered TRANSACTION_ERROR: 29189
[ 1722.822856] binder: 11822 RLIMIT_NICE not set
14:03:31 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x580001c000000000]})

14:03:31 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x4, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:31 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x2, 0x2)
write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffff9c, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0)={<r2=>0xffffffffffffffff}, 0x13f, 0x1000}}, 0x20)
write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r1, &(0x7f00000002c0)={0xb, 0x10, 0xfa00, {&(0x7f0000000180), r2}}, 0x18)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r3 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0xfffffe2c}}, 0x0)

14:03:31 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1400000000000000]}, 0x2c)

14:03:32 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1500000000000000]}, 0x2c)

14:03:32 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6005000000000000]})

14:03:32 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:32 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x101000, 0x0)
getsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, &(0x7f0000000040), &(0x7f0000000080)=0x4)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:32 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
sigaltstack(&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000000000))

14:03:32 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1800000000000000]}, 0x2c)

[ 1723.632775] binder: send failed reply for transaction 270 to 11824:11826
14:03:32 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000), 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:32 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6105000000000000]})

14:03:32 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00000000000000]}, 0x2c)

[ 1723.714070] binder: undelivered TRANSACTION_COMPLETE
[ 1723.722490] binder: undelivered TRANSACTION_ERROR: 29189
14:03:32 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0xffffffffffffff00, 0xc0080)
ioctl$NBD_CLEAR_SOCK(r1, 0xab04)
socket$key(0xf, 0x3, 0x2)
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[]}}, 0x0)

14:03:32 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe4ffffff00000000]}, 0x2c)

14:03:32 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000001, 0xffffffffffffffff, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x2000000}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f0000000000)=0x2000000000000008, 0x0, 0x4, &(0x7f0000000040)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

[ 1723.811512] binder: release 11856:11863 transaction 272 out, still active
[ 1723.818489] binder: undelivered TRANSACTION_COMPLETE
14:03:32 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7005000000000000]})

14:03:32 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1723.865851] binder: send failed reply for transaction 272, target dead
[ 1723.884643] binder: send failed reply for transaction 273 to 11873:11874
14:03:32 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}, 0x2c)

[ 1723.975094] binder: undelivered TRANSACTION_COMPLETE
[ 1723.981093] binder: undelivered TRANSACTION_ERROR: 29189
[ 1723.986575] binder: 11886:11887 transaction failed 29189/-22, size 0-0 line 2896
14:03:33 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe80000000002709eac20000000000aafe800000000000000000000000000000"], 0x50}}, 0xfffffffffffffffe)
socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000240))
r2 = socket$inet_smc(0x2b, 0x1, 0x0)
r3 = creat(&(0x7f0000000000)='./file0\x00', 0x80)
getsockopt$inet_sctp_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000080), &(0x7f00000000c0)=0xb)
ioctl$sock_inet_tcp_SIOCINQ(r2, 0x541b, &(0x7f0000000100))

14:03:33 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000), 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:33 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
getsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000340), &(0x7f0000000380)=0x4)
timer_create(0x0, &(0x7f0000000080)={0x0, 0x40, 0x6, @thr={&(0x7f0000000000)="e463231c2b09d76d1a8e17febd45cca49e8d4384e8b0ebce626f447d241d6a95e31ef9b302a8bd49346224e62cb97790ca4570420d2bbd78db1c5a3d502f321a83e59031", &(0x7f0000000200)="afcc50fd8dd0af2137689e92c67d53a7e53713c2481cd06ad5c49a73b84a18910ddaec960b9544d531589be555702b56bfab896f5403b756c2bcd8ab7b7a9ff03a6be7ee1b60efabd2782aeb759b823f493e2e34beec1d25fe9443535ef3c09eecb5f1bf69bc81b7129c606c2bf302e34f60dcea6482259941bc32e7e9a68c69d500a74d80e949f78a94df9afdd7cc2ce87bf77c4ddb469c9272ca749bedecf58de276715c"}}, &(0x7f0000000100)=<r1=>0x0)
timer_settime(r1, 0x0, &(0x7f0000000140)={{}, {0x0, 0x1c9c380}}, 0x0)
r2 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000003c0)='cpuacct.stat\x00', 0x0, 0x0)
ioctl$VIDIOC_S_DV_TIMINGS(r2, 0xc0845657, &(0x7f0000000400)={0x0, @reserved})
futex(&(0x7f0000000300)=0x8000000000, 0xa, 0x0, 0x0, 0x0, 0x2)

[ 1724.075135] binder: undelivered TRANSACTION_ERROR: 29189
14:03:33 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:33 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7105000000000000]})

14:03:33 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}, 0x2c)

[ 1724.118322] binder: 11901:11902 transaction failed 29189/-22, size 0-0 line 2896
14:03:33 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}, 0x2c)

14:03:33 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0})

[ 1724.230591] binder: undelivered TRANSACTION_ERROR: 29189
14:03:33 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0aa4574763476b8540b3c414ff646ea09555")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
r2 = openat$zero(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/zero\x00', 0x4002, 0x0)
getsockopt$inet_sctp_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000200)=@sack_info={<r3=>0x0, 0x0, 0x9}, &(0x7f00000002c0)=0xc)
setsockopt$inet_sctp6_SCTP_AUTH_KEY(r2, 0x84, 0x17, &(0x7f0000000300)={r3, 0xb0f, 0xfe, "6c990ae76c43bfcdf9495e7d60417c5d17d7c4fcd59654dce6cb8d854063961e73d2bae170c7f70d7fec15437b26aec330bcf040e34542cd0b80cf6f97e35e9f23610f421db64adbb1af1a9f65d8cc158af78bf6e2ead4ed6c9e7b912c41e861a9d58ace5741a16d0b38373cf295f34a45981913d407b3d02daef55341cc75ac1481974a6cf3cfea545c77cf439c9ce6caa1c90389cb373b2f82eeb4c17241054fbaeeb0b31cddb0288c1275134baa4b2e317352e95775f6b1df9361b0c6974aebdba7b5eb18cce766796adc2d696b3bd0c7d5a50c5ce88ea7a471fb2bb35bf234177a805d3d83502e9ee0b95b6f3b9cb1b90334d556ecfb7da653bb6d85"}, 0x106)

[ 1724.305082] binder: release 11912:11914 transaction 277 out, still active
14:03:33 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x2c)

[ 1724.345665] binder: undelivered TRANSACTION_COMPLETE
14:03:33 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

14:03:33 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7205000000000000]})

[ 1724.379663] binder: send failed reply for transaction 277, target dead
[ 1724.386422] binder: send failed reply for transaction 278 to 11921:11922
14:03:33 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}, 0x2c)

14:03:33 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f123c123f3188b070")
r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x2, 0x0)
ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f0000000080)=0x5)
ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f00000000c0)=ANY=[@ANYBLOB="02400000"])
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

[ 1724.472869] binder: undelivered TRANSACTION_COMPLETE
[ 1724.484417] binder: 11930:11934 ioctl c0306201 0 returned -14
[ 1724.484465] binder: undelivered TRANSACTION_ERROR: 29189
[ 1724.574409] binder: release 11930:11934 transaction 281 out, still active
[ 1724.603879] binder: undelivered TRANSACTION_COMPLETE
[ 1724.626473] binder: send failed reply for transaction 281, target dead
14:03:33 executing program 5:
socket$nl_generic(0x10, 0x3, 0x10)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x1, 0x80)
futex(&(0x7f000000cffc), 0x81, 0x0, 0x0, 0x0, 0x0)

14:03:33 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0})

14:03:33 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x2c)

14:03:33 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7401000000000000]})

14:03:33 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

14:03:33 executing program 3:
syz_genetlink_get_family_id$nbd(&(0x7f0000000000)='nbd\x00')
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="02160000b150af85ed400a00000000000000000000fe0800120000000000000000000000000006000040000780ef71b40000000000000000000000fe800000000000001d000000000000aafe800000000000000000"], 0x50}}, 0x0)
r2 = inotify_init()
r3 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm_plock\x00', 0x6000, 0x0)
ioctl$SCSI_IOCTL_GET_PCI(r3, 0x5387, &(0x7f00000001c0))
dup2(r2, r2)

14:03:34 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}, 0x2c)

[ 1724.952798] binder: 11953:11958 transaction failed 29189/-22, size 0-0 line 2896
[ 1724.966038] binder: 11949:11955 ioctl c0306201 0 returned -14
14:03:34 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}, 0x2c)

[ 1725.010127] binder: release 11949:11955 transaction 284 out, still active
[ 1725.033857] binder: undelivered TRANSACTION_COMPLETE
14:03:34 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

14:03:34 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000080)="0adc1f123c123f3188b070")
sendmsg$key(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000380)='/dev/snapshot\x00', 0x301000, 0x0)
fchmod(r1, 0x101)
getsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f00000000c0), &(0x7f0000000100)=0x4)
getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000540)={<r2=>0x0, @in={{0x2, 0x4e23, @multicast2}}, 0x101, 0x8000}, &(0x7f0000000000)=0x90)
getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f0000000600)={r2, @in={{0x2, 0x4e23, @multicast1}}}, &(0x7f0000000040)=0x84)
ioctl$SNDRV_TIMER_IOCTL_GINFO(r1, 0xc0f85403, &(0x7f0000000440)={{0x1, 0x3, 0x8, 0x1, 0x9}, 0x4, 0x10000, 'id0\x00', 'timer0\x00', 0x0, 0x3f, 0xe1c4, 0x100000000, 0x3})
ioctl$SIOCGSTAMP(r1, 0x8906, &(0x7f0000000400))
sendmsg$key(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)={0x2, 0x7, 0x5, 0x3, 0x12, 0x0, 0x70bd2b, 0x25dfdbff, [@sadb_x_nat_t_port={0x1, 0x16, 0x4e20}, @sadb_x_kmaddress={0x8, 0x19, 0x0, @in6={0xa, 0x4e24, 0x7, @mcast2, 0x3}, @in6={0xa, 0x4e22, 0xffff, @mcast1, 0x7ff}}, @sadb_x_filter={0x5, 0x1a, @in6=@initdev={0xfe, 0x88, [], 0x1, 0x0}, @in=@rand_addr=0x81, 0xb, 0x10, 0x4}, @sadb_sa={0x2, 0x1, 0x4d3, 0x7, 0x0, 0x8a, 0x2, 0x1}]}, 0x90}}, 0x48804)

14:03:34 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7501000000000000]})

14:03:34 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0})

[ 1725.072595] binder: send failed reply for transaction 284, target dead
[ 1725.095314] binder: undelivered TRANSACTION_ERROR: 29189
[ 1725.169971] binder: 11974:11975 ioctl c0306201 0 returned -14
[ 1725.222458] binder: release 11980:11981 transaction 287 out, still active
[ 1725.242329] binder: undelivered TRANSACTION_COMPLETE
[ 1725.299790] binder: release 11974:11975 transaction 286 out, still active
[ 1725.306844] binder: undelivered TRANSACTION_COMPLETE
[ 1725.324372] binder: send failed reply for transaction 286, target dead
[ 1725.332572] binder: send failed reply for transaction 287, target dead
14:03:34 executing program 5:
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x400000000000800, 0x400)
getsockopt$bt_rfcomm_RFCOMM_CONNINFO(r0, 0x12, 0x2, &(0x7f0000000040)=""/90, &(0x7f0000000100)=0x5a)

14:03:34 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9]}, 0x2c)

14:03:34 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000000)='/proc/self/net/pfkey\x00', 0x80200, 0x0)
write$P9_RRENAMEAT(r1, &(0x7f0000000080)={0x7, 0x4b, 0x1}, 0x7)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a000000000000000000000008001200000000000000000000000000fe8000000000000040000000000000aafe80000000000000000000000000000000000000000000000000000000000000"], 0x50}}, 0x0)
getsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f00000000c0)={<r3=>0x0, 0x6}, &(0x7f0000000100)=0x8)
setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f00000002c0)={r3, @in6={{0xa, 0x4e23, 0x7, @remote, 0x200}}}, 0x84)

14:03:34 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, &(0x7f0000000040)})

14:03:34 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7601000000000000]})

14:03:34 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1725.842654] binder: 11992:11993 transaction failed 29189/-22, size 0-0 line 2896
14:03:34 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}, 0x2c)

14:03:34 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, &(0x7f0000000040)})

[ 1725.896576] binder: undelivered TRANSACTION_ERROR: 29189
14:03:35 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7702000000000000]})

14:03:35 executing program 3:
r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/btrfs-control\x00', 0x102, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r0, 0xc0305302, &(0x7f0000000080)={0xe1f6, 0xffffffffffffffc0, 0x6, 0x14a, 0x4, 0x2})
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r2 = socket$key(0xf, 0x3, 0x2)
connect$l2tp(r0, &(0x7f00000000c0)=@pppol2tpv3={0x18, 0x1, {0x0, r1, {0x2, 0x4e23, @remote}, 0x1, 0x4, 0x4, 0x4}}, 0x2e)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:35 executing program 5:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
readv(r0, &(0x7f0000000100)=[{&(0x7f0000000200)=""/4096, 0x1000}, {&(0x7f0000000000)=""/37, 0x25}, {&(0x7f0000001200)=""/222, 0xde}, {&(0x7f0000001300)=""/4096, 0x1000}, {&(0x7f0000000040)=""/118, 0x76}], 0x5)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

[ 1725.985724] binder: release 12006:12007 transaction 292 out, still active
[ 1726.011039] binder: undelivered TRANSACTION_COMPLETE
14:03:35 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, &(0x7f0000000040)})

14:03:35 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb]}, 0x2c)

14:03:35 executing program 3:
r0 = syz_open_dev$swradio(&(0x7f0000000100)='/dev/swradio#\x00', 0x1, 0x2)
creat(&(0x7f0000000000)='./file0\x00', 0x2)
inotify_add_watch(r0, &(0x7f0000000080)='./file0\x00', 0x40000000)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:35 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mISDNtimer\x00', 0x20000, 0x0)
syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x0, 0x2)
open$dir(&(0x7f0000000000)='./file0\x00', 0x400000, 0x8)

14:03:35 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7900000000000000]})

[ 1726.186692] binder: release 12024:12027 transaction 294 out, still active
14:03:35 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc]}, 0x2c)

14:03:35 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:35 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x21, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646"})

14:03:35 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, 0x2c)

14:03:35 executing program 5:
inotify_init1(0x80800)
r0 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0xff, 0x2000)
arch_prctl$ARCH_SET_GS(0x1001, 0x80)
r1 = perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x5, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000200)=@assoc_value={<r2=>0x0, 0x7}, &(0x7f0000000240)=0x8)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000280)={r2, 0xfffffffffffff635, 0x2}, 0x8)
faccessat(r1, &(0x7f00000001c0)='./file0/file0\x00', 0x0, 0xc00)
setxattr$trusted_overlay_origin(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)='trusted.overlay.origin\x00', &(0x7f0000000180)='y\x00', 0x2, 0x3)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
msgget$private(0x0, 0x521)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:35 executing program 3:
r0 = accept4$packet(0xffffffffffffff9c, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000340)=0x14, 0x80000)
getsockopt$bt_hci(r0, 0x0, 0x2, &(0x7f0000000380)=""/89, &(0x7f0000000400)=0x59)
socket$inet_udplite(0x2, 0x2, 0x88)
r1 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x400, 0x8000)
r2 = syz_genetlink_get_family_id$SEG6(&(0x7f00000000c0)='SEG6\x00')
sendmsg$SEG6_CMD_SETHMAC(r1, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)={0x44, r2, 0x311, 0x70bd2d, 0x25dfdbfd, {}, [@SEG6_ATTR_ALGID={0x8, 0x6, 0x4}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x5}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x3}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x9}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x40de7be4}, @SEG6_ATTR_SECRETLEN={0x8, 0x5, 0x5}]}, 0x44}}, 0x20000000)
r3 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:35 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a01000000000000]})

[ 1726.699994] binder: release 11995:11997 transaction 291 out, still active
[ 1726.714744] binder: send failed reply for transaction 291, target dead
14:03:35 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}, 0x2c)

[ 1726.764988] binder: send failed reply for transaction 292, target dead
[ 1726.782487] binder: send failed reply for transaction 294, target dead
14:03:35 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf]}, 0x2c)

14:03:35 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b01000000000000]})

14:03:35 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x60583, 0x0)
ioctl$TUNGETFEATURES(r1, 0x800454cf, &(0x7f0000000080))
socket$key(0xf, 0x3, 0x2)
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:35 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f0000000080)=0x1, 0xa, 0x0, 0x0, 0x0, 0x1)
r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x83, 0x400)
ioctl$PPPIOCSNPMODE(r0, 0x4008744b, &(0x7f0000000040)={0x80ff, 0x3})

14:03:36 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10]}, 0x2c)

14:03:36 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1727.559802] binder: release 12047:12055 transaction 297 out, still active
[ 1727.569548] binder: send failed reply for transaction 297, target dead
[ 1727.576262] binder: send failed reply for transaction 298 to 12049:12059
14:03:36 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:36 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f04000000000000]})

14:03:36 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11]}, 0x2c)

14:03:36 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = accept$inet(r0, &(0x7f0000000000)={0x2, 0x0, @empty}, &(0x7f0000000080)=0x10)
getsockopt$inet_sctp_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f00000000c0), &(0x7f0000000100)=0xb)
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

[ 1727.629714] binder: undelivered TRANSACTION_ERROR: 29189
14:03:36 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12]}, 0x2c)

14:03:36 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000c000000000]})

14:03:36 executing program 3:
kexec_load(0xff, 0x4, &(0x7f00000003c0)=[{&(0x7f00000000c0)="7ed662dfb05742d1c0b7e725c7a1e961b763fb430231b81340a39a7641530d9f946ebf4b4aface0bad", 0x29, 0x800, 0xa1df}, {&(0x7f0000000100)="676335bc2b928aa1f6", 0x9, 0xcd, 0xc2}, {&(0x7f00000001c0)="05c3f2631e22a6405f415c262319a2faa6b01b", 0x13, 0x3, 0x8001}, {&(0x7f0000000200)="4e8ec2ee91dba8eca2f6f178db1e5db759ca8f8d0ce47f005909ae8c2bedd220755a8da0c1ee47b692", 0x29, 0x8e15, 0x4402}], 0x280002)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='trusted.overlay.upper\x00', &(0x7f00000002c0)={0x0, 0xfb, 0xc8, 0x4, 0x25d9, "e3757f92bb371181b55d9f10b52dcdd6", "20b373d21c85bfe01b006e48fc9b8d3e2041bdf07c5716a61d6d1a3ca6edb6e6ece7a4f57b90649d0832db16e48725015a0f8caaedfe8997bac591000d2b12567c2fbce6ce1b7fea7a30d7ee3ea841c60fad707be5bae2dd01aca6612df3578533c46246879f2b73cf5c0a731aaa887696d3e380084728e6b6eae2011a0f21ecd5f2ffe07ef7b68d22e59de60490eda84d06f4cfd382249563bbb0b31952ee601b59662b150a67d2ff247d9a4e63dec5f29ad6"}, 0xc8, 0x1)

14:03:36 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13]}, 0x2c)

14:03:36 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x204200, 0x0)
ioctl$KVM_SET_MSRS(r0, 0x4008ae89, &(0x7f0000000040)={0x4, 0x0, [{0x8f0, 0x0, 0x5}, {0x0, 0x0, 0x7}, {0xb7b, 0x0, 0x1}, {0x274, 0x0, 0x4}]})

14:03:36 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14]}, 0x2c)

14:03:36 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x40200, 0x0)
ioctl$VIDIOC_G_AUDIO(r1, 0x80345621, &(0x7f0000000080))
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r2 = socket$key(0xf, 0x3, 0x2)
r3 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r3, 0x1000008912, &(0x7f0000000040)="0adc1f123c12a41d88b070")
syz_emit_ethernet(0x300b00, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd60b409f8ff07000000020000000100000000ffffe0000002ff020000000000000000000000000001880090780007040060b680fa0000100000000000000000000000ffffffffffff00000000000000000000ffffac14ffbb"], 0x0)
ioctl$sock_inet_SIOCGARP(r3, 0x8954, &(0x7f00000000c0)={{0x2, 0x4e20, @local}, {0x0, @local}, 0x0, {0x2, 0x4e21, @broadcast}, 'syzkaller1\x00'})
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="080800120000000000000000000000000006ce603f8d390ae33600000000000000fe8000000000030000000000000000000000000000000500000000000000000000000000e5ffffffffffffff0000000b6620322ad34df33c78b69ebdc965a7c9d88a9e2b8ef0f0465995ef489cff8754a35b4eff8c00f31f8a"], 0x50}}, 0x0)

14:03:37 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1728.419077] binder: send failed reply for transaction 301, target dead
[ 1728.427221] binder: send failed reply for transaction 302 to 12098:12099
14:03:37 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, &(0x7f0000000040)})

14:03:37 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
setxattr$trusted_overlay_upper(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='trusted.overlay.upper\x00', &(0x7f0000000200)={0x0, 0xfb, 0xa2, 0x4, 0x5, "793365976e993f0d106252487b0482c0", "299d3bd80595a09afc61c760de2539bdf1b693b663b4b69056edd048d5ed3c7e7df638706df1e7933656bd0e8072eacb997184ba95a7913064969ef719f0ee8608bd81e673eac572a3ca31f8bce1cfab4f77be273de391f415dc2b9b44fc7130976f0e8b02827250b93e70c3d08bfad5b761ee8c889ffcce834c9d7fb90f86df35104474aa243c9ac5c036d2f0"}, 0xa2, 0x1)
lsetxattr$security_smack_transmute(&(0x7f0000000080)='./file0\x00', &(0x7f0000000100)='security.SMACK64TRANSMUTE\x00', &(0x7f0000000140)='TRUE', 0x4, 0x2)
futex(&(0x7f000000cffc), 0x6, 0x2, 0x0, 0x0, 0x223)

14:03:37 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8004000000000000]})

14:03:37 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x15]}, 0x2c)

14:03:37 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
ioctl$DRM_IOCTL_AGP_ACQUIRE(r2, 0x6430)

14:03:37 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18]}, 0x2c)

14:03:37 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, &(0x7f0000000040)})

14:03:37 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
r2 = creat(&(0x7f0000000000)='./file0\x00', 0x20)
setsockopt$inet6_buf(r2, 0x29, 0xd7, &(0x7f00000002c0)="872d5fb5e846582a3074b47b7371ec112e0854cd9267073c17cc257f858410f26d03491c344a8656a5acb2b8a93e037d89586c1402fd5572889f336652d61b5408e432f0ca409857c3467e128a97ffdd4c463e323b4a6d3189a7ce2d7312a0014f2cb293bbf77fc592c367cc0408b3de5eff896b257f322fbe82300db35b61654f039bd4b76d4631586071d1c2", 0x8d)
clock_gettime(0x0, &(0x7f0000000080)={<r3=>0x0, <r4=>0x0})
ioctl$VIDIOC_QUERYBUF(r2, 0xc0585609, &(0x7f00000000c0)={0x8, 0x7, 0x4, 0x44401, {r3, r4/1000+30000}, {0x2, 0x0, 0x1, 0x48, 0xfffffffffffff89e, 0xbd, "fdfda21c"}, 0x4ca, 0x2, @offset=0x7, 0x4})
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
openat$vfio(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vfio/vfio\x00', 0x10000, 0x0)

14:03:37 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}, 0x2c)

14:03:37 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8005000000000000]})

14:03:37 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, &(0x7f0000000040)})

[ 1728.763581] binder_release_work: 7 callbacks suppressed
[ 1728.763585] binder: undelivered TRANSACTION_COMPLETE
14:03:38 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:38 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500]}, 0x2c)

[ 1729.269781] binder_thread_release: 4 callbacks suppressed
[ 1729.269792] binder: release 12129:12130 transaction 305 out, still active
[ 1729.282499] binder: undelivered TRANSACTION_COMPLETE
14:03:38 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
r0 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x91a, 0x800)
ioctl$SG_NEXT_CMD_LEN(r0, 0x2283, &(0x7f0000000040)=0xa2)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:38 executing program 0:
socketpair(0x80000000001, 0x1, 0x0, &(0x7f0000000040)={<r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x8943, &(0x7f0000000300)='0\x00')

14:03:38 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x810000c000000000]})

14:03:38 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008913, &(0x7f0000000000)="0adc1f050500000000000000baded699683736aa7b499150404e4232a9000000000000000000000000")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000120000000000000000000006000040000000000070a4396100000000000000fe8008000000000000000000000000342338454703aafe8000000000"], 0x50}}, 0x0)

14:03:38 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600]}, 0x2c)

14:03:38 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700]}, 0x2c)

14:03:38 executing program 0:
bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x12, 0x2a, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000063010d000000000095000000000000004efed3e1141aaf38ea21265ff46d3d72ccbb75636d6d3d42d79e70e09485cd22647f7c581506b2df928fa0017f6739863f46f84653e6c34d41fba3720ee56bc51bce93b8c1ee6383eff0730187bb15895293847297b57f2446b910adf56226ac437e934f5c28caddeaf73291d70b096e0359b6b631950e08a8daa6e87958c086a1b2dc9fd9d3a901d165af9ad9e86298d74067787e7e845890c84bfe1a38ab4970f3ad3e20ed4df3e7960db2b9c7db807a4dfa314b59d374e91b460e751dce8aa453392793a542427199ddbb83bf08fbacb0c598b4856b3bc2793c7797879c37824d8d1aa9fc6433b65e48bde670268304cbf88cd8f06b8a94242a8368d3285557b8455f8bae69165bebc5ae453d8c90d938473030b1ca6e3ea5c2d1bc3934db57b7e63f2892f9eec9ecba8e93051f2071de5b4d5de4e1"], 0x0, 0x7fffffff, 0xfb, &(0x7f0000000380)=""/251, 0x0, 0x0, [], 0x0, 0xb}, 0x48)

14:03:38 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = syz_open_dev$usb(&(0x7f00000001c0)='/dev/bus/usb/00#/00#\x00', 0x1000, 0x40000)
ioctl$CAPI_MANUFACTURER_CMD(r1, 0xc0104320, &(0x7f0000000380)={0x1, &(0x7f0000000200)="176e19a9d6e55b1c09ede897ed73bd82c1b635a3867481e6ebfdc3e2a431"})
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x10000, 0x0)
getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffff9c, 0x84, 0x6f, &(0x7f00000000c0)={<r4=>0x0, 0x1c, &(0x7f0000000080)=[@in6={0xa, 0x4e21, 0x2000000000000000, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x64a}]}, &(0x7f0000000100)=0x10)
setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f00000002c0)={r4, @in6={{0xa, 0x4e21, 0x1ff, @local, 0x4}}}, 0x84)

14:03:38 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f0000000100)=0x2000000000000004, 0x0, 0x3, &(0x7f0000000140)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
rt_sigsuspend(&(0x7f00000000c0)={0x5}, 0x8)
r0 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0xc000)
ioctl$KVM_SET_CPUID(r0, 0x4008ae8a, &(0x7f0000000040)=ANY=[@ANYBLOB="05000000000000000b0000000100010007000000080000000000000000000000080000803f00000003000000080000000600000000000000010000c00700000001000080ff0f00002ac4000000000000000000800900000000040000f4000000050000000000000000000080a80a0000ffffffff060000000400000000000000"])

14:03:38 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900]}, 0x2c)

14:03:39 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:39 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
setxattr$trusted_overlay_opaque(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='trusted.overlay.opaque\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x1)

14:03:39 executing program 0:

14:03:39 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x820000c000000000]})

14:03:39 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00]}, 0x2c)

[ 1730.179646] binder: release 12170:12171 transaction 314 out, still active
[ 1730.215930] binder: undelivered TRANSACTION_COMPLETE
14:03:39 executing program 0:

14:03:39 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c)

[ 1730.229200] binder_send_failed_reply: 4 callbacks suppressed
[ 1730.229207] binder: send failed reply for transaction 314, target dead
14:03:39 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000005000040000000000000000000000000fe8000e84e0ce33e192804b661145d28000000000000000000000000aafe8000"], 0x50}}, 0x0)

14:03:39 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x830000c000000000]})

14:03:39 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00]}, 0x2c)

14:03:39 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00]}, 0x2c)

14:03:39 executing program 0:

14:03:40 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:40 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/sloppy_sctp\x00', 0x2, 0x0)
r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x8400, 0x0)
ioctl$KVM_IOEVENTFD(r2, 0x4040ae79, &(0x7f00000001c0)={0x1000, &(0x7f00000000c0), 0x8, r3, 0x2})
ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f0000000000))

14:03:40 executing program 5:
rt_sigtimedwait(&(0x7f0000000080)={0x8}, 0x0, &(0x7f0000000100)={0x77359400}, 0x8)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x101000, 0x0)
ioctl$SG_GET_SG_TABLESIZE(r0, 0x227f, &(0x7f0000000040))
ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000140)={'vcan0\x00', <r1=>0x0})
sendmsg$can_raw(r0, &(0x7f0000000300)={&(0x7f0000000200)={0x1d, r1}, 0x10, &(0x7f00000002c0)={&(0x7f0000000240)=@canfd={{0x4, 0x1, 0x81, 0x9}, 0xf, 0x1, 0x0, 0x0, "28e63268951756b7a414037f25488955ce68c1cd5dab62c3d13da47ff1c47294bced2cc90532dd36fab161c787e18f9c6c5048c397fc02018f7669372f5c9dab"}, 0x48}, 0x1, 0x0, 0x0, 0x90}, 0x8094)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:40 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x840000c000000000]})

14:03:40 executing program 0:

14:03:40 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}, 0x2c)

[ 1731.109930] binder: release 12220:12223 transaction 317 out, still active
[ 1731.116935] binder: undelivered TRANSACTION_COMPLETE
[ 1731.131674] binder: send failed reply for transaction 317, target dead
14:03:40 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0xa00000000000000, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:40 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00]}, 0x2c)

14:03:40 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f00000002c0)="14b44ce70db97b3638e4f0d50b492c626ff99c1660434e116f3801f42eb165b0b94740247e79b304eb05fa8b915191a5b1bc3e3701d1a288b6c8a8b1b5b6446630df42127316b19234b295e5fa0edbdb73c4f16d0a0e70ca6c07faff22d20900d9526e9e097a197803ec804fa015e7d74af8fb1d591a9a2ba86a3c4853799d6f8a7d34c549fd4d4ec9b0561ee3c4566fd00d8515e79ca64a7dbcc89b1560981d7e68c785f75de09f462705f06ef4fdda99635d618ac60dede65cfb1363560a5139323d5a658e988cfe3ab9ed4f9e822ab712d9ad91a5e4eb5c44")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:40 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8501000000000000]})

14:03:40 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1100]}, 0x2c)

14:03:40 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:41 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:41 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1200]}, 0x2c)

[ 1731.968573] binder: release 12258:12259 transaction 320 out, still active
[ 1731.975746] binder: undelivered TRANSACTION_COMPLETE
[ 1732.006919] binder: send failed reply for transaction 320, target dead
14:03:41 executing program 5:
r0 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x5, 0x20000)
setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r0, 0x28, 0x2, &(0x7f0000000040)=0x7, 0x8)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:41 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000080)={{0x3e, @local, 0x4e21, 0x0, 'ovf\x00', 0x2, 0x2, 0x1}, {@loopback, 0x4e24, 0x7, 0x80000000, 0xda9, 0x40}}, 0x44)
getpeername(r0, &(0x7f0000000500)=@vsock={0x28, 0x0, 0x0, @host}, &(0x7f0000000580)=0x80)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-monitor\x00', 0x80101, 0x0)
getpeername$packet(0xffffffffffffffff, &(0x7f00000006c0)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000700)=0x14)
ioctl$TUNSETIFINDEX(r1, 0x400454da, &(0x7f0000000740)=r2)
r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000480)='/dev/sequencer\x00', 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r3, 0xc0045516, &(0x7f00000004c0)=0x101)
accept$packet(r3, &(0x7f0000000100)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000400)=0x14)
ioctl$TUNSETIFINDEX(r3, 0x400454da, &(0x7f0000000440)=r4)
r5 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000000000000fe8000000000000000000000000000aaf1800000000000000000000000000000"], 0x50}}, 0x0)
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f0000000200)={0x8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0, 0x0]}, &(0x7f00000002c0)=0x24)
getsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f0000000300)={r6, @in6={{0xa, 0x4e22, 0x6, @dev={0xfe, 0x80, [], 0x27}, 0x28b4eb7a}}}, &(0x7f00000003c0)=0x84)
fremovexattr(r0, &(0x7f00000001c0)=@known='com.apple.system.Security\x00')

14:03:41 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8601000000000000]})

14:03:41 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1300]}, 0x2c)

[ 1732.017121] binder: send failed reply for transaction 321 to 12282:12283
[ 1732.045691] binder: undelivered TRANSACTION_COMPLETE
[ 1732.063408] binder: undelivered TRANSACTION_ERROR: 29189
14:03:41 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1732.086801] IPVS: set_ctl: invalid protocol: 62 172.20.20.170:20001
14:03:41 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1400]}, 0x2c)

[ 1732.137810] IPVS: set_ctl: invalid protocol: 62 172.20.20.170:20001
[ 1732.188660] binder: BINDER_SET_CONTEXT_MGR already set
14:03:41 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8701000000000000]})

14:03:41 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = socket$key(0xf, 0x3, 0x2)
r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dlm_plock\x00', 0x200000, 0x0)
getsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000001500)={@loopback, @broadcast, <r3=>0x0}, &(0x7f0000001540)=0xc)
sendmsg$nl_route_sched(r2, &(0x7f0000001600)={&(0x7f00000014c0)={0x10, 0x0, 0x0, 0x84000000}, 0xc, &(0x7f00000015c0)={&(0x7f0000001580)=@delqdisc={0x2c, 0x25, 0x1, 0x70bd29, 0x25dfdbff, {0x0, r3, {0xd, 0xfffb}, {0xffe9, 0xffff}, {0xf, 0xfff3}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xffffffff}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x4040800)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a0000000000000000000012fd4aab77000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe80000000000000000000"], 0x50}}, 0x0)

[ 1732.216898] binder: 12308:12309 ioctl 40046207 0 returned -16
[ 1732.245366] binder: 12315 RLIMIT_NICE not set
14:03:41 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1500]}, 0x2c)

14:03:41 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:41 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4, 0x0, &(0x7f0000000000)=[@enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:03:41 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x8, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:41 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8705000000000000]})

14:03:41 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1800]}, 0x2c)

14:03:41 executing program 5:
recvmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, <r0=>0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @empty}}}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000100)=""/88, 0x58}, {&(0x7f0000000200)=""/165, 0xa5}, {&(0x7f00000002c0)=""/191, 0xbf}], 0x3, &(0x7f0000000380)=""/41, 0x29}, 0x20)
getsockopt$inet_dccp_int(r0, 0x21, 0x3, &(0x7f0000000400), &(0x7f0000000440)=0x4)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:41 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
pipe2(&(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x84800)
r2 = dup(r0)
ioctl$NBD_SET_SOCK(r1, 0xab00, r2)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r3 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

[ 1732.879567] binder: release 12289:12290 transaction 324 out, still active
[ 1732.886526] binder: undelivered TRANSACTION_COMPLETE
14:03:41 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00]}, 0x2c)

[ 1732.925005] binder: send failed reply for transaction 324, target dead
14:03:42 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000000)={<r0=>0x0}, &(0x7f0000000040)=0xc)
ptrace$setregset(0x4205, r0, 0x206, &(0x7f0000000080)={&(0x7f0000000100)="829a338dadab4442fae09e56a47a0373e60ec22a70cda74e6ee301695cd63bf4becda2a0e4b503184a6ec3bf0dcba87a511aa7b35a794aa7696d6322279b2d8df7849c03b9e81b1e4c4fda7f0b8b8dd414df6ef89b73441f5ddb17e753cf64cc8e7f78d5732a11d90901868e16928c6a29106bf4f227f2fb587a930bd6e4b1", 0x7f})
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:42 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x7, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:42 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="021600000a00000081000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000ec56b3627a7618cd25ddfca7ef5a6c3fc170b18e12e5de0e16134a93abb5363a6d2d8b19abd5a7ff1c77fb0a400beaf42aa29212fc8701bab7fd1654a53fb381532601e07bdfd395410f597546d8db704831217cd73870a6ca10f6a567fb498b00fe9a5f672c8c722d25268662"], 0x50}}, 0x0)
getsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x14, &(0x7f0000000100)={@remote, <r2=>0x0}, &(0x7f00000001c0)=0x14)
setsockopt$RDS_GET_MR_FOR_DEST(r0, 0x114, 0x7, &(0x7f0000000380)={@hci={0x1f, r2, 0x1}, {&(0x7f00000002c0)=""/149, 0x95}, &(0x7f0000000200), 0x14}, 0xa0)

14:03:42 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8b00000000000000]})

14:03:42 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}, 0x2c)

14:03:42 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x0, 0x0, 0x0})

14:03:42 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x6, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:42 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
keyctl$join(0x1, &(0x7f0000000080)={'syz', 0x2})
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f0000000000)=<r0=>0x0)
sched_rr_get_interval(r0, &(0x7f0000000040))

14:03:42 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
syz_genetlink_get_family_id$team(&(0x7f00000001c0)='team\x00')
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe8000000000a59f28f8046aea4200005a31569aadaa950cc212f78c04ed9dd49966001be9d462140c4a3c6a69858e65f23c9dcf8f53429c486cd0465d33e20319fb4984bb75638e37c9695645db2b5ad0e6acc316d72116fd28ffe8179d85674d963301a8e41f22362251a3e928479f70f5519022aa364b1619f7335184dbcb6fdf1f45846ebb9750340cb90c519667a3895ef958c1760bafc8e89d1335ef8766328bb507ee875ad08ebe12bded3b6cf59662d852e08f139729abd95f4418b85e02ab88ca21465bb99e72cffdb69fcb6e4196e1f843a73149b4b71e0800000001c97325a2147c5fc8ec3736e42a6f43a64a0e5fe914da36f896919f0a06a5be31aa95c16e3765b5506b8c11f603b992c6a60c83444340ab7607f7a47f30065b9bbfdc9a6f9d9c7da429ba773e1c0a9a186403ee7eabca705fc463e5c6d6013456d5cea816947d61e2a60cd769d64863220724c53227494d3c2f633129b0d682bcfa273b5c91290474060b8f81013755778fa3e6924b152e31950f3771d387e8a2bd0738044dc9503c417c85681226a7d4ba76b5adba3bed237deec59aba2549f4a6f3fc6696006d39dea4d15c5098f0a230048f646c8c64ba974522d4698424a3312d4e1add1ece5c7356"], 0x50}}, 0x0)
r2 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x9, 0x598bb610535b7194)
ioctl$TIOCNOTTY(r2, 0x5422)
ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r1, 0xc0a85320, &(0x7f0000000080)={{0xfffffffffffffffd, 0xff}, 'port0\x00', 0xe, 0x41013, 0x9, 0x318, 0x56a, 0x8001, 0xf9, 0x0, 0x1, 0x2000000000000})

14:03:42 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000]}, 0x2c)

14:03:42 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900d000000000000]})

[ 1733.780028] binder: release 12345:12348 transaction 327 out, still active
[ 1733.787084] binder: undelivered TRANSACTION_COMPLETE
[ 1733.797527] binder: send failed reply for transaction 327, target dead
14:03:42 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff]}, 0x2c)

14:03:42 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x6, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:42 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}, 0x2c)

14:03:43 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000008533ec0000000000000000fe8000000000000000000000000000aafe8000000010000000000000003cb0d4fb8f49adf9424090fdd5756f6e32e0106593d57906a39479a1d16fc8330c6033bc671e"], 0x50}}, 0x0)
r2 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x3f, 0x80600)
getsockopt$MISDN_TIME_STAMP(r2, 0x0, 0x1, &(0x7f00000001c0), &(0x7f0000000200)=0xfffffffffffffe44)

14:03:43 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9104000000000000]})

14:03:43 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x80, 0x88040)
ioctl$EVIOCGABS0(r0, 0x80184540, &(0x7f0000000200)=""/206)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0x9, 0x0, 0x0, 0x0, 0x223)

[ 1733.942630] binder: release 12386:12389 transaction 329 out, still active
[ 1733.966476] binder: undelivered TRANSACTION_COMPLETE
14:03:43 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x0, 0x0, 0x0})

[ 1734.015606] binder: send failed reply for transaction 329, target dead
14:03:43 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0xc, 0x0, &(0x7f00000000c0)=[@free_buffer], 0x0, 0x0, 0x0})

14:03:43 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x2c)

[ 1734.141000] binder: release 12410:12411 transaction 332 out, still active
[ 1734.147971] binder: undelivered TRANSACTION_COMPLETE
14:03:43 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
bind$inet(0xffffffffffffffff, 0x0, 0x0)
write$P9_RSETATTR(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = socket$inet6(0xa, 0x40000080806, 0x0)
io_getevents(0x0, 0x0, 0x0, 0x0, 0x0)
bind$inet6(r1, &(0x7f000047b000)={0xa, 0x4e20}, 0x1c)
listen(r1, 0x1ffffffe)
openat$hwrng(0xffffffffffffff9c, 0x0, 0x40000, 0x0)
ioctl$KVM_SET_FPU(0xffffffffffffffff, 0x41a0ae8d, 0x0)
r2 = socket$inet6(0xa, 0x2, 0x0)
r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000080)='/dev/hwrng\x00', 0x28000, 0x0)
ioctl$DRM_IOCTL_RES_CTX(r3, 0xc0106426, &(0x7f0000000140)={0x4, &(0x7f0000000300)=[{}, {}, {}, {}]})
connect$inet6(r2, &(0x7f0000419000)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r4 = accept4(r1, 0x0, &(0x7f0000000000), 0x0)
ioctl$VHOST_SET_OWNER(0xffffffffffffffff, 0xaf01, 0x0)
ioctl$IMCLEAR_L2(r4, 0x80044946, &(0x7f00000000c0)=0x9)
fsetxattr$trusted_overlay_redirect(0xffffffffffffffff, 0x0, &(0x7f0000000500)='./file0\x00', 0x8, 0x1)
sendmmsg(r4, &(0x7f0000003d40)=[{{&(0x7f0000001b00)=@l2={0x1f, 0x2a, {0x700, 0x0, 0xea010009, 0x1000000}, 0x0, 0xe803000000000000}, 0x80, &(0x7f0000001d00), 0x0, &(0x7f0000001d40)}}, {{&(0x7f0000002300)=@nl, 0x80, &(0x7f0000003740), 0x0, &(0x7f00000037c0)}}], 0x4000000000001eb, 0x0)
ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, &(0x7f0000000080))
r5 = dup2(0xffffffffffffffff, 0xffffffffffffffff)
bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000100)={r5, &(0x7f0000000340)="a4f008e5f3c0273a9ab8a27eb2cb96a6b035f303c276b1bdd6756e03682c62c17cb9ff67dee9ed7d59e46e4fed7c09fc6743be865428197c317377dbf16d1b0fa636ffa727c21bcb61a8e381a78f32b34c9e881076ed2a26fb336070e929d30f9c0130fccdea977d33514b44f82ac51424870573d223b53a7814ccdddc6e3c619ba4293250bdd1b9099db2bd2b498292990e23c35ba4a89ef6bfe56e5b6abdfd8112af92ab1d0fcc79285ef47736f1c52c0ccd49a1fce514b073aa1457d73c9824232130c65785aeac3b495f0828b0911faa7e8f9503dcdf04444823fee7a2426d884d75b39458572bc9bda7267d0098a8f78ffeb246b1b3d61c", &(0x7f00000001c0)=""/121}, 0x18)
write$binfmt_elf64(0xffffffffffffffff, &(0x7f0000000540)=ANY=[@ANYBLOB="7f454c4606075d03080000000000000003003e00090000fdfc516b06b20088020000000000004000000000000000e503000000000000018000000000380002000500000006000500000000000000080000000000000004000000000000000500000000000000fdffffffffffffffff0300000000010001000000000000001bc714874f05a956e396cf349babe50d9a2c5017e99edcb85f46d01563cb6fdf810237bd4915143f6449db9279e6af56a13672d8365ecdde6db6dd321ca3d62e59430523fe590a840169a119941a7c8c190364d2fe8d64b0c700a072c9abbd2ae79ba300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x1e1)
r6 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe800000000800000000e4ffffff00aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:43 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x0, 0x0, 0x0})

14:03:43 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}, 0x2c)

[ 1734.183516] binder: BINDER_SET_CONTEXT_MGR already set
[ 1734.200628] binder: 12416:12417 ioctl 40046207 0 returned -16
[ 1734.215544] binder: send failed reply for transaction 332, target dead
[ 1734.244967] binder: 12416:12417 transaction failed 29189/-22, size 0-0 line 2896
14:03:43 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9e00000000000000]})

[ 1734.295716] binder: 12416:12417 BC_FREE_BUFFER u0000000000000000 no match
[ 1734.316699] binder: undelivered TRANSACTION_ERROR: 29189
14:03:43 executing program 0 (fault-call:6 fault-nth:0):
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:43 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000]}, 0x2c)

[ 1734.379619] binder: release 12426:12427 transaction 336 out, still active
[ 1734.392818] binder: undelivered TRANSACTION_COMPLETE
14:03:43 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x0, 0x0, &(0x7f0000000040)})

14:03:43 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f00000001c0)=<r2=>0x0)
ioctl$sock_FIOSETOWN(r0, 0x8901, &(0x7f0000000080)=r2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="021600f20900000000000000000000000800120000000000200000000099d7b00afb7bfe8626b1af00000006000040000000000000000011040000fe8000000000000000000000000000aafe800000000000000000000000000000e8248db9de9396a8b94607eb3db217c321b137647a508faf7c9ead5680c2ca6ca796d92fabb72687572a155e65638e87a6ca9a35b21ec31cc5637ac6c97042b93ec4080744c98fd3c6590f256b7b8020918acd703cb956293abea2816d784f778561cecee0c547283cfed8066cac6a14fb3b8f6604619968909b7d68dea7d8882260588145c8363f44b467f4bf3b4ab830e5a92fce"], 0x50}}, 0x0)

[ 1734.449204] binder: send failed reply for transaction 336, target dead
[ 1734.452891] binder: 12438:12441 transaction failed 29189/-22, size 0-0 line 2896
[ 1734.499422] binder: release 12443:12444 transaction 340 out, still active
[ 1734.514951] binder: undelivered TRANSACTION_COMPLETE
[ 1734.525550] FAULT_INJECTION: forcing a failure.
[ 1734.525550] name failslab, interval 1, probability 0, space 0, times 0
[ 1734.575685] binder: send failed reply for transaction 340, target dead
[ 1734.581632] CPU: 0 PID: 12445 Comm: syz-executor.0 Not tainted 5.0.0-rc8 #87
[ 1734.589570] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1734.598939] Call Trace:
[ 1734.601542]  dump_stack+0x172/0x1f0
[ 1734.605187]  should_fail.cold+0xa/0x1b
[ 1734.609064]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 1734.614157]  ? lock_downgrade+0x810/0x810
[ 1734.618307]  ? ___might_sleep+0x163/0x280
[ 1734.622447]  __should_failslab+0x121/0x190
[ 1734.626672]  should_failslab+0x9/0x14
[ 1734.630459]  kmem_cache_alloc_trace+0x2d1/0x760
[ 1734.635114]  ? kasan_check_read+0x11/0x20
[ 1734.639337]  ? do_raw_spin_unlock+0x57/0x270
[ 1734.643730]  ? _raw_spin_unlock+0x2d/0x50
[ 1734.647951]  binder_get_thread+0x1db/0x7c0
[ 1734.652179]  binder_ioctl+0x1e2/0x1b79
[ 1734.656055]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 1734.661582]  ? binder_thread_write+0x2820/0x2820
[ 1734.666327]  ? debug_smp_processor_id+0x1c/0x20
[ 1734.670989]  ? perf_trace_lock+0xeb/0x510
[ 1734.675143]  ? mark_held_locks+0x100/0x100
[ 1734.679367]  ? zap_class+0x460/0x460
[ 1734.683074]  ? __fget+0x340/0x540
[ 1734.686515]  ? find_held_lock+0x35/0x130
[ 1734.690563]  ? __fget+0x340/0x540
[ 1734.694042]  ? binder_thread_write+0x2820/0x2820
[ 1734.698807]  do_vfs_ioctl+0xd6e/0x1390
[ 1734.702684]  ? ioctl_preallocate+0x210/0x210
[ 1734.707078]  ? __fget+0x367/0x540
[ 1734.710522]  ? iterate_fd+0x360/0x360
[ 1734.714327]  ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[ 1734.719938]  ? fput+0x128/0x1a0
[ 1734.723212]  ? security_file_ioctl+0x93/0xc0
[ 1734.727609]  ksys_ioctl+0xab/0xd0
[ 1734.731054]  __x64_sys_ioctl+0x73/0xb0
[ 1734.734935]  do_syscall_64+0x103/0x610
[ 1734.738816]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 1734.744015] RIP: 0033:0x457e29
[ 1734.747217] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 1734.766119] RSP: 002b:00007fb7a42bfc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 1734.773812] RAX: ffffffffffffffda RBX: 00007fb7a42bfc90 RCX: 0000000000457e29
[ 1734.781080] RDX: 0000000020000100 RSI: 00000000c0306201 RDI: 0000000000000004
[ 1734.788340] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000
[ 1734.795594] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb7a42c06d4
[ 1734.802850] R13: 00000000004bf15a R14: 00000000004d0b00 R15: 0000000000000006
[ 1734.818443] binder: 12438:12445 ioctl c0306201 20000100 returned -12
[ 1734.879519] binder: undelivered TRANSACTION_ERROR: 29189
14:03:43 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0xe6ca, 0x4280)
clock_gettime(0x0, &(0x7f0000000100)={<r1=>0x0, <r2=>0x0})
timerfd_settime(r0, 0x1, &(0x7f0000000140)={{0x0, 0x1c9c380}, {r1, r2+10000000}}, &(0x7f0000000200))
ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r0, 0xc0045520, &(0x7f0000000080)=0x5)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f0000000040)=0x4, 0x7, 0x0, 0x0, 0x0, 0x2)

14:03:43 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9f00004000000000]})

14:03:43 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000]}, 0x2c)

14:03:43 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x0, 0x0, &(0x7f0000000040)})

14:03:43 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = syz_open_dev$rtc(&(0x7f00000000c0)='/dev/rtc#\x00', 0xfffffffffffffedb, 0x40000)
ioctl$RTC_ALM_READ(r1, 0x80247008, &(0x7f0000000100))
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
r3 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0x400, 0x20c000)
ioctl$EVIOCSKEYCODE_V2(r3, 0x40284504, &(0x7f0000000080)={0x0, 0x1a, 0xfffffffffffffff7, 0x5, "29e1e0b20f386a1f6579f15c2b51441637e594915e0c17311568b32e38d80ebd"})

14:03:43 executing program 0 (fault-call:6 fault-nth:1):
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:44 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000]}, 0x2c)

[ 1735.003278] binder: release 12461:12462 transaction 343 out, still active
[ 1735.025999] binder: undelivered TRANSACTION_COMPLETE
14:03:44 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x0, 0x0, &(0x7f0000000040)})

14:03:44 executing program 3:
dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe80000000000000000011be01df57eae6470000000000000000000000000000"], 0x50}}, 0x0)

14:03:44 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000]}, 0x2c)

[ 1735.082852] binder: send failed reply for transaction 343, target dead
[ 1735.092312] binder: send failed reply for transaction 345 to 12457:12458
14:03:44 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa001000000000000]})

14:03:44 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1735.212852] binder: release 12475:12476 transaction 348 out, still active
[ 1735.249670] binder: undelivered TRANSACTION_COMPLETE
[ 1735.264904] binder: send failed reply for transaction 348, target dead
[ 1735.294951] binder: send failed reply for transaction 350 to 12486:12487
14:03:44 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dsp\x00', 0x101000, 0x0)
ioctl$RTC_WKALM_SET(r0, 0x4028700f, &(0x7f0000000040)={0x0, 0x1, {0x3, 0x34, 0x8, 0x8, 0x6, 0x69a7, 0x1, 0x51, 0xffffffffffffffff}})
socket$inet6_udplite(0xa, 0x2, 0x88)
ioctl$GIO_SCRNMAP(r0, 0x4b40, &(0x7f0000000080)=""/9)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:44 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x21, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646"})

14:03:44 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000]}, 0x2c)

14:03:44 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00d000000000000]})

14:03:44 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='net/fib_triestat\x00')
bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000002c0)={r2, &(0x7f00000001c0)="5cda51f208c71efd1d9fe1065fa04ebe74ec2081d29c196aa3d262d1b73cc318af4330584924d4ad962e67d447dbf72071de6555e91ef6828759d67fe1fa50d9c40199c10f443ca095f2c852dc9eef68c44705a74246418b2932d1ff82c79eada9dc7e00acee08062e624ce7959d04af6c24c1f2a027c16c5d97"}, 0x10)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
r3 = syz_open_dev$usb(&(0x7f0000000000)='/dev/bus/usb/00#/00#\x00', 0x80, 0x40000)
ioctl$VIDIOC_ENUMINPUT(r3, 0xc050561a, &(0x7f0000000080)={0x9, "ef3817a3c862dd81194e619438900313ce4a558b1747da4cf9d81b136676fa0a", 0x0, 0xbc7, 0x7, 0xffffff, 0x20012})

14:03:44 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:44 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9000000]}, 0x2c)

[ 1735.895957] binder: release 12498:12507 transaction 356 out, still active
[ 1735.935572] binder: undelivered TRANSACTION_COMPLETE
14:03:44 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:45 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000]}, 0x2c)

14:03:45 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(0xffffffffffffffff, 0xc00c642e, &(0x7f0000000000)={0x0, 0x80000, <r0=>0xffffffffffffffff})
ioctl$DRM_IOCTL_AGP_ALLOC(0xffffffffffffff9c, 0xc0206434, &(0x7f0000000040)={0x3, <r1=>0x0, 0x2, 0x4})
ioctl$DRM_IOCTL_AGP_BIND(r0, 0x40106436, &(0x7f0000000080)={r1, 0xffff})
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

[ 1735.951609] binder: release 12498:12507 transaction 355 out, still active
[ 1735.978835] binder: undelivered TRANSACTION_COMPLETE
14:03:45 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:45 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb000004000000000]})

14:03:45 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb000000]}, 0x2c)

[ 1736.060912] binder: release 12521:12522 transaction 357 out, still active
[ 1736.075402] binder: undelivered TRANSACTION_COMPLETE
[ 1736.096953] binder: release 12521:12525 transaction 358 out, still active
14:03:45 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x21, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646"})

14:03:45 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:45 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc000000]}, 0x2c)

14:03:45 executing program 5:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_MODIFY_ATTRIBUTES(r0, 0x4008240b, &(0x7f0000000000)={0x7, 0x70, 0x101, 0x342da734, 0x800, 0xc7e7, 0x0, 0x200, 0x9010, 0x8, 0x6, 0xfb7, 0x3, 0x7, 0x7f, 0x2, 0x3, 0x88, 0x0, 0x1, 0x1, 0x8, 0x950, 0x5, 0xfffffffffffffffc, 0xca, 0x401, 0x3f, 0x3, 0x5, 0xfffffffffffffff7, 0x4, 0xc45, 0x10000, 0x2a, 0x200000000, 0x10000, 0x94, 0x0, 0xff, 0x0, @perf_config_ext={0x7, 0x10000}, 0x10000, 0x0, 0x7b8, 0xb, 0x20, 0x6, 0x200})
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:45 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x0, 0x2)
ioctl$VIDIOC_CREATE_BUFS(r1, 0xc100565c, &(0x7f00000003c0)={0x5, 0x0, 0x0, {0x7, @sliced={0x7, [0x3, 0x4, 0xfffffffffffffff8, 0xffff, 0x7fffffff, 0x401, 0x401, 0x5, 0x101, 0x0, 0x10001, 0xfffffffffffffffb, 0x10000, 0x109, 0x8, 0x5, 0x5, 0x51ed2adf, 0x72e, 0xffffffffffffff01, 0x4, 0x6cbf, 0x19f2, 0x4, 0x1, 0x5, 0x0, 0x9, 0xffff, 0x2, 0x47, 0x4, 0x1, 0xffffffff, 0x1, 0x7, 0x3, 0x1, 0x9, 0x6e, 0x0, 0xfffffffffffffffb, 0x8, 0x78, 0x984, 0x6, 0x96, 0x101], 0x1}}})
ioctl(r0, 0x100000890e, &(0x7f0000000040)="0adc1f123c123f3188b070")
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000827c27b42ad7a7ee90c6206d800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe810000"], 0x50}}, 0x0)
r3 = syz_open_dev$sndpcmp(&(0x7f0000000380)='/dev/snd/pcmC#D#p\x00', 0xfffffffb, 0x4000)
ioctl$VIDIOC_TRY_DECODER_CMD(r3, 0xc0485661, &(0x7f0000000080)={0x7, 0x3, @raw_data=[0x6, 0x7, 0x1f, 0x100, 0x1f, 0x400, 0x8, 0xfffffffffffffffc, 0x2, 0x4409, 0x400, 0x401, 0x72, 0x0, 0xa73, 0x8]})

14:03:45 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb700004000000000]})

[ 1736.709659] binder: release 12495:12505 transaction 353 out, still active
[ 1736.726865] binder: send failed reply for transaction 353, target dead
[ 1736.743884] binder: 12549:12551 transaction failed 29189/-22, size 0-0 line 2896
14:03:45 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd000000]}, 0x2c)

[ 1736.762525] binder: send failed reply for transaction 355, target dead
[ 1736.769285] binder: send failed reply for transaction 356, target dead
[ 1736.783162] binder: 12549:12551 transaction failed 29189/-22, size 0-0 line 2896
[ 1736.797904] binder: send failed reply for transaction 357, target dead
14:03:45 executing program 5:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x10001, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
r1 = fcntl$dupfd(r0, 0x406, r0)
setsockopt$TIPC_MCAST_REPLICAST(r1, 0x10f, 0x86)

14:03:45 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1736.830705] binder: send failed reply for transaction 358, target dead
[ 1736.849168] binder: undelivered TRANSACTION_ERROR: 29189
[ 1736.862683] binder: undelivered TRANSACTION_ERROR: 29189
14:03:45 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008914, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a0000000000000000000000080012866441e6d416223c000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:45 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}, 0x2c)

14:03:46 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc000000000000000]})

[ 1736.958791] binder: release 12566:12568 transaction 365 out, still active
14:03:46 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x21, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646"})

14:03:46 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:46 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:46 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf000000]}, 0x2c)

14:03:46 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
r2 = dup(r0)
ioctl$SNDRV_RAWMIDI_IOCTL_DROP(r2, 0x40045730, &(0x7f0000000000)=0x81)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:46 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc100000000000000]})

[ 1737.633635] binder: send failed reply for transaction 362, target dead
[ 1737.649572] binder: send failed reply for transaction 364, target dead
14:03:46 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000]}, 0x2c)

[ 1737.712970] binder: send failed reply for transaction 365, target dead
14:03:46 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x2000, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r0, 0xc4c85512, &(0x7f0000000200)={{0x9, 0x5, 0x7, 0x3, 'syz1\x00', 0x5}, 0x0, [0x81, 0x2, 0x7, 0x0, 0x12, 0x80000001, 0x6, 0x8000, 0x9b04, 0xffff, 0x6, 0xbcb, 0xbb7, 0x5, 0x6, 0x7fff, 0x0, 0xd33, 0x2, 0x9, 0x6c1, 0x0, 0x1, 0x2, 0x2, 0x200, 0x7, 0x0, 0x6, 0x2, 0x3, 0xc50c, 0x1ff, 0x1f, 0xdc, 0x3027, 0xffff, 0x8, 0x5, 0x20, 0xffffffff, 0x5, 0x100, 0x4, 0x80, 0x8001, 0x20, 0x2, 0x80, 0x0, 0xffffffffffff75d9, 0xfffffffffffffffa, 0x12, 0x8, 0x0, 0x6d07, 0x100000000, 0x4, 0x6, 0x64, 0x4, 0x80000000, 0x1, 0xfffffffffffffff9, 0x7, 0x60000000000, 0x2a4, 0x4, 0x956, 0x3f, 0x0, 0x7fff, 0x80000000, 0x5374, 0x1, 0x10000, 0x7, 0x10000, 0x7, 0x7fffffff, 0x10001, 0x5b, 0x1, 0x7ff, 0x401, 0x7, 0x2, 0x6d, 0xf, 0x0, 0x5, 0x9, 0x6, 0x80000001, 0x8001, 0xffffffffffffff81, 0x8000, 0x0, 0x0, 0x3ff, 0x8, 0x89d6, 0x10000000, 0x3, 0x80000001, 0x0, 0x10001, 0x8, 0x9, 0x0, 0x4, 0x7, 0x9, 0x4, 0x3, 0x9, 0x5, 0x6, 0x2, 0x9, 0x8, 0x3ff, 0x6, 0x8, 0x5, 0x100000000, 0xffff, 0x1], {0x0, 0x1c9c380}})

14:03:46 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
r2 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x1e, 0x10000)
ioctl$PIO_SCRNMAP(r2, 0x4b41, &(0x7f0000000080)="3e49ef66b9735b190c8064dc58b82964015d7114bbf4a9e19de24d6136f64318450ca2ef5a439906f5f17345bb91f7eaffe9b624ca871e0f69b9fdb635a1c4a1170a27ad2eeb32735a9b49144ec3e9fe52becf15e7c149d37bd0f1ba58a70fafb6977ba379485f34e8d73dee2e449507db0e")

14:03:46 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:46 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc200000000000000]})

14:03:46 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11000000]}, 0x2c)

14:03:47 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x31, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5e"})

14:03:47 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f0000000200)="fee109445ff4e64b2bb92e702068662b823af0d17c06bf2138a5e36e179ac959f8d4ddd66fc199cf36ca6e711d9a39e95a4e57547b6873dea8e42a7a1a5a72526154b5f8bbec1a14f5f2e2b17c9913c67c4a0ec2f869e5895761cee2bb538a7f9c404cfd3fea21b3a553670c4e3e5ff2a732a31390b42cf81c2ee7277fe41c8019762dfd1494b1b5b57cf54246c905ad1cb27ed1fb2c15b009a3301771be25e5ffd105623c2f1bf92638642ee7b69a82b94aa3b2982a075a6d99be17a55bafdd5aabe9c3", 0xc4)

14:03:47 executing program 3:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x200000, 0x0)
r1 = socket$l2tp(0x18, 0x1, 0x1)
ioctl$LOOP_SET_FD(r0, 0x4c00, r1)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r3 = socket$key(0xf, 0x3, 0x2)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000080))
ioctl$VIDIOC_S_FBUF(r0, 0x4030560b, &(0x7f0000000100)={0xc2, 0x20, &(0x7f00000002c0)="ea5a4637ba6d3b1cd295dd3cf78746495e79f88f9e2fab848ac75acf457d16051951dac0111dcd73ca73209cc2294ad45587225a73fcc53eb4917fe6514111a477cc8c374fd3920d4b32b1fb656ffe0bfd86c27f43fcecf9a61119106791d6146238104f01a6ba296a31b8993652df0843e0a8151c2921699ab988a1a092124d85740b3e55da8920224779d0058092188ad3d7adfed2fa744c0a802769fec7dc526269b11f704e16bc48403661009fb01fde9728cb090cc21a7a1ac9787a9591febce4e05316974a4762c4297955edd44a826f95569139e44d85bd9c71e6405eeea124102a67320c2e347128fcce4868eb453450f7eab158d16b8983b6502eea638412a24c24fbb939a3e4c9006b2d3feafaba1c0a00308e02d29df666d038a21076ea75cdfdee59de7b3288b03740ddd75f9ce3493a2a6c7b94f97d6a749c31ef015d853fbefc5bb8175f271e37eea92f45e40982575e5d947601cc1740fe2b5afc5c61e442dd241eb6d7b2c4f14efbdd1ca87b53ed88a23c11067196b00ad504599d960e3357832fb1ea6421627d0c9efce685d7d97eb456af7b3420c22b3144ab4655aebafee3f85954789aa847b6430bd5c4cb2cf0b2f215006a9a625d10c5dbd2410968ec592351705de2bd86388059ff7ee749070a9002f4bb14783fa3f814098ea4bf4a379b8227823e88f1680b1d8d578485027c217df75a274f8c177dd2077d2373baa3132a1298326ce7a98eddcc72d735fb39a868e77ad0db7aea9d21d3bd4c3e06e6d0ebd81e817035a0b73a9f452461c2e92a602e17f83da3818eb507eec4cf2bb5c37597b6d69e8593ca3f7f4c649e7e9ec7b269c21b495ed803767c9f76be7431f272b2f9545e895da5528bfa908fc767ec79861c2fdbf6684db8dcba99206052155caec89be184605d27b41092d3720b15af983ca63206f4d82a3335596ae6cae708abe0a31ece28b8072a89529bb3a5f4126abc0970bcaaef535bd76a86555ae3abae37bc7a6ba0f06df0ef6a2bd28613acf211f0f40b0cad8c98555971692a5209d3f93ca790c977d0c107609e3397411ca99080066543ca74cfadc7d29bbfc461b4595ac600acf615fbd2872f36d51d2ef48a13c8fde56672bd20886e80429b6c9261cfbeb0c46d0cb6294f8523546c8d884a05c2ce2442dc4bc9ad576ef11d9b892be641a58ec7c205ffd87528fd214cf84d060589e817dde1cc706057b741ac7b6a2d498849d3be92879fa74c77038f6818c98c0099d390c858f87fe9a5e21e01365470b8cec7ea9b26f5c38ddbe70fda193c37127461bbadf3cf8e2e2a2274d6b67394dc363abc34b68db8c87b40e8d4c320a24a292514680ecc2fbfd25cccc42fad586c99c798cfafc4f328916cea1c45e8c75070fa8e03fe22c1af0237fd1013746d00a9089312702ed725bfd9cd3ef4bc68d8d575bd2570c25f822cf096944439c8bda84fa0399adab8858dd4c5cc4fbcb8d7c587c856053b73895a268e8cd6489a017e3f66f0a569907910459027a6da0e61a9d9769a5be899bdbed69310c6d2f62ada42d034cf4eb0d38f6e15f6b07b72592361ce40297292193c2734e52ab9eeaf17c5e44fb8016c99001f29264c46a734256aa67cdec5a68d1c62dcaeea89ff2db8d372d5edbabb6813061136fa74f7f24783ced860f5207950507fc6b1b7c2caddb3e00711914d2cf6dc8c36f2ffd26de0acb65baa7402e9baeef2e12821a900f07cb10ff99e9397ac4be2e8f40aa4c0b952a45268cf25453eee1ab2b7266c27ad98ae9e95d294cdc4b1d03ab7467a62d8d43cc96bdb15a10dc784ade2138b9191dca047780b7604773f5b529eb4f573acfcab77a4202f12693883fc88ca2758c83277b8c1300df99c0618a07ccb53a6ae0ad7bb4916d3bacb1a1889644d6bd8d9799b7efafa1c31ffdb802491cd3839f44f117efca2e96f98f1236e51767b1e4f385da1c758a867376a1bbff8f3b7d315898304d82781ae356cb18af50af66ca13121cfcb64e8faf9aaea26b3ad582370951e3c824428ac86af8f3d1c3b1986b90a88ceb0d61e1e9a9d49cccdb640aae2ba95ac7872e9056ea258f6643b881b409e3f3dfb51c079ed4a560baab52243d380440a087887397aca4d193c65c37287a3edca482b5d012d4ec934efee38e1886945a26e2400bfef398786ad4b22b19c9508f25723a391e2f59c47cd855db5b6a645ae13a8cb486043038afff6208f3a44cc5a3c9749c17f5355c8e4501a9753563676da83e00f319a172b14e9ccfdaf421d47ea213c929498590d46cc26404d969f0b40597c4821966fc45d598ae1899588ab58b42777445dbd722b094e40a5188f62dd3be2028ec5f6f20892f435137b7a296e69a092f4c5935864036c9f4517cc7db86522a7d18dbbb1f9a9d7326540c9ee8a3218b71b9ca53fb98e943de8884ab24043ef5b46cf827486bb665770c60a4eaee40ce92597c8a53c0b6fae86e61b1e03a2dfdddbcaf94195aae3db16455631c4c3e19b3f8c00488d34570af5567c4dc069a4ad51ad147aecb1b9169569705733bb51f79b7b7079867fb8025d53f1b267590d5e7fd5d7c56977854d3167b63e4ca73f7794432cf894a3b6dae1de97342a61dd88af9a060cef5177c82f01f5cb486f50a4c101d4ce718f4ca5d1eb0b8922ffc3495a19453c20d25db71deddd1716b65ef3877de80d7853cc36de340c2dcc87c790b0c859463c526216731dd05092eb357f09a66672bd5b39a340eb37c33f41246bac0d4ff8a6d0db4518e096c777d496218251b24c7e32e3cc8277bfc59074a2b1a83e0bf7b634ade476452a120be9ab26c5628e7b673d8f7be1f3cbe37530934156d722beb0327711e0a7b6e782eb9dd888c6f1aceeedce53703582d876ec70684aceca1d84a7ba11147e242d24de873f4a9b7ae1312c5c9bd02a16e9c91dc0bf99f472d4b40e9bf8a19d90ed0427d2fba8d6e0827a8cba59ce7571beb6d4e0ba42e25c695d57163e7ecfa8df6087620bd678cef5fb2833003175a363f0492e3fdd488882199340e83ad9de62acc691a53ff76113c27d87145d629cf0bfe2ffbf368b07e80399e3067baa8f49c5154946e405913e9657eab56da993abd372fb661a20d27b5c8958e8e55d3321e57cd4b804061a96c4cc1029dcb8ebd621f41db8b7f1150fa508136c610b221779b7ece70e66b03600047553fc05a7084eedec39ecbc54960e5c73a2f75b1c394c16c28707e92f87c11cd2bd28ac256e4ca4936e664378eb55c620339439230d0b8fa48b04f00e83ab18e4a29a5f3065701339cd0fcd0f009c9784cc62db79c4cdd507e6576299aee024bd21dfbcbb948fe305aec5a118762c5d67d19f24a7368298702047432aea9db5620c94fa1d68490435b4b8ebf3baa7b43ec86aa2ccd71e4140cabb4dc10e02d2969e3c2c8c45bcba24117a16bcca8a48cbb87b13a0e998ff59930262849b8cba73c5e512debaaaa39df8e1ea1180900d2019b76274db1a2317bc68efee430ba92e2ad4f0e65621a8c62fd149423a6822842d17b9cf028d7fe7a535a0ff8e63723ff1a16e38ef9f41489caf68aced88631be870cd563af3836df5df522f12f247ffb38e2e1f5c7b70816f9457e2d5579d62eb9dbf749c43e3c615bf188ff61d3992a3ab53feb482ae404dc90fe7c4b859fd5ae7c4723b4e1c39ff2f9d48773e2c1266bf2dbeeff461175dbd7a2049e058359dc995a33d7f2cbc8d75b74e0664fab1d70721fd1d23f200bbef1160ae9157c6778ab9274146d044804f32cc24e704500ff3808b95f5df01dabe2d22761d9dca373bcd19906d8fb6cde85b98375744a19a2eedd257be79ba9b765fcce2f3a2f9f1948df23e410dae7471afe00ca9c30e518e5ac565244963f504f07107d74c926903b253931cb24d0526325c04b8f036e28fb3aa8fe48c3e1e313c8903284679ba9b31b7fe05e8882ca141a6424472188891047829adeeea8715b2ce8b9c4b30e411c14f04d850298675afeda6a268c73ea388959590619b7e07d52835ff31a6f4aecd6b786c6e964eb37a45e8c82dacf9608eccc0293b5526bb843456d3b1ce0ac1dc670b05b7e91f47ec01e266b2155e49ee04f0e2129b22d1eda2a4cc842e45112a2e09acc77d04abfe950cc775f960d6bb1e9855809e534d5e3369bb6cd0b2ea6c45596bfdc5593d58db029bdabeaaf3f661a974733e7b6f00d1c495be1640bed52355ef2e9901dea04a699755ae8eecb2f53b4377c1675f646a87c1e78b78f45b32e4a765131f43c6ff74d96deace9590f8104e40c4c81ce3fde74c84a8b1f62f9d428f3d204181b5d815be9b0c5ecd7aeb62a1a3e16917b3c23750648ccfea06df924dc4ab527604f5d935ca7504d5f81770ad9e80fbcfb8e956c82795def7738b23157806d11e07648ba73f224762e7bd0ab9b50b46b66068ce4be3151cc6b6c9c04396303578ea96269ed2655c39e138e27c87267e7629c25980c89db21dbe8a48d3a8285a3a60e4bfdd5f27d99910dfb0b7ec15471493c24d65c4d0e12549f76db58f7fcef196d67295ced290dfa95b3abb825b83d35da2bc5ad17787409734e0d63000b333bd0735be46961d61bcf34647f0e989123e4fdbc05dcc394714f43c0c88f7119a2c88518b11f67ff880f027c4a93fd24c653d1d11a4a5269baf20669f040dad24b41a542bee1ed79fc8875bbb49d996a14d98cbb8b78da0ebbfb82d6f50175219f7c06bfa5fb61b2ab06b04dcb0b9af43e80bcd25c73479b7288c3323fba4a72d2cbda246fe092592a2026faf5397380da70a8cd221f9be7919e5c2f342e1ad875da2ac40636ca6213fdf76af2d1d46e747763272ceb7771e88e51133a50d9c2d64d065c14706413bb3531ba96e2630306395e4f08353d6a705894b1f4d3ac8c2597b8b7a11be3070f20921a80ab53b5325eca92464d8946c47b461f1a4a1a270d540086f6f30c175458717f37153d1a1d561d4baed8ca74890c59f0ec5f59587a84b1651babea3f566ac49bcabdc446fcd9643be5cc4e1eb3eda5c258a027c2a2867d9f7d04f981dfc5895d9dd807dadf579af13412edcacc21d7689554ab837ebb62f2167457a53e1fbfca430b776b6837e825286d7ab765c951269f0d0fd76435ce53b1095ca09b038da74e8c3c08a2b130a26efb0ff542fe492adcf9518eee6bdc828de7fc738647c8665d4abf9614994f311cd3356ac00d22d3b5a80944add20abfde7d28c6f35f992b0b3a1dd5417bb988c5626feb4c6d66894b03f453794ee3d2313cbb5bd640f43002a94f1292a27c66e8f2e85e639b24db7d9402e25e94c8b7c89c11175a52931e9172218cc332ec0d10d214e7f008d5ac01ccc8e3285953f33e2c625b727417d8c230d09284af5b0db229be3ececd361d83c7acdda463f2c1190eca48a477895df800dd6dacde5c2aa6f578f2f52dd2fc5da91b33ab52b38f6a95e9098a008656773df5df786c7778deea08d8e471d08859b4151a33fd50a944905d02b67845abba9c21d62b4606e8ae03730792a16d8df8295e775a57f3ff844c64fc8dc8aa0db8766376686b17680b67f6b86f191ebd67c26c4f021b48f52c8e95e071705aeddf50ac47c56ab4672326189b5fc691d8d545ace0911b90197967bb8a0b73686bc2be84ded4120c15f1dd244cfa2260285e2d71b4eccd7682adb364fc4c6b0627bd51f28759c1cbe593301df9a5bb75dd7f6b34f7c9c98ef07d74e5d01d31c36c8e74cfcf1c86986c387b86d2a407260cac6eccf62a3d56fc29a520bd5", {0xfff, 0x2, 0x0, 0xf, 0x5, 0xfffffffffffffffa, 0xb, 0x5}})
sendmsg$key(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000040000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:47 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12000000]}, 0x2c)

14:03:47 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:47 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xce00000000000000]})

[ 1738.539942] binder: send failed reply for transaction 367, target dead
[ 1738.589371] binder: 12639:12640 transaction failed 29189/-22, size 0-0 line 2896
[ 1738.606357] binder: undelivered TRANSACTION_ERROR: 29189
14:03:47 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:47 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13000000]}, 0x2c)

14:03:47 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f0000000000)=0x2, 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:47 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
r2 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0xffffffffffffffff, 0x2)
fremovexattr(r2, &(0x7f0000000140)=@known='system.posix_acl_access\x00')
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
ioctl(r0, 0x1, &(0x7f00000002c0)="dfb11f39839366582af10e06c4a9e5be25ed46ca8d573ed979542dd2bff0b660ff43ddee55928026217311e65213f6263f9d231db5d3ddc630d24d82ee351b8ef3dd486fa407152a7360bb9d2a6f9eaef28007d93ce75608fc6a39eed7dd055115e5fa1d1be0f14896d0e78549e4555244d633aa0a49a0dfe40ba94b298bd730db3865e3bfe9365d32e25096f3ebbcfb696a0696471aa62bc0711494ee671178d40767373525462dd60323d83bb1e6082c8390e0058d9a8f3d75d13a83738b5fb815f98a6a44fff12039458843c554adbb9eb740526ced52fc9aff157092805c99efb1dadaa6635329b1ce62112aed6ca7deb71edbbec7eba808ce62dbcb39376530b1fbf2793acd2e7e83c69c68172d2fbaf75f65942453fcb438869ba329f29500ba2b8c37c79569a9a70a0285ca471339f808264b3cdfb7ba131a4bba86d5843623ea9442c17e53be1a6a8a73d05de0961d1d7938501bfb9fc83ff7e61861cb54356747c7c78e39769450c6b65f9a388a8a7a5c1324b8985ead7226256bbc89aa5ce5208bff1f4a6bfd3a360008fdf4cb5a1a7212b11fbb39fa5645d1e0c7bfe6c1b1dcba4c07b5766d7db27bbc6b47dd192039cdbbc2e676ba5a5ef8dcce551ac5b1a164ab6cd40c17f73d0855637a07e1d0f3941f3541e500f5eabe9a74d5303ad3ffaca0ef3197f6b672478934ab158c49cae27eb1b02b84eb98da11396898a621a59f458059d24941c3a6922507c8d4866ab5138dd90474904209f68ffa2282e7c3f67f49ade7f3e2efd5244c70411a9081be12f9633e6011dba29e767a9dd683ed4ccd8d86d818533176168f3c8a79c003c68d521446f9aa443dd4b00fffd0a0b0e0907b0c09a58ce9dca43e4e111ec2bf85a041e3664954407d165fdd1679e00ddd3a462caa44ff861c4bab59acc812b8fe512ff297edeb70528efbdb3c3afe21883d257f76d724c5e37fd348c7c0fd9833c24871ef64445bb7cdd25141fa34002b165193cefc033eb44a21a589c4d0fa41438f777d5841831439319cdfeaa1b929f25118927cf3e1a7ba04dfdbc782eda5d86060462ce41e83bf5d3c124dc16f110f54b4d404c09c7fe23ebdf979acaf3f2e82f52a0dcdb44e054a3b00523eca6aa634c71f8cb75697b6b12db163d553b0487ce4acfc64747031bd3c221cf537e4113cab31a0713bc80e465532bbb241b5387596553af31f6aae7bc0ed856b393e94bcd1970d96135c6b036b065f3635d5348d304590412f13cf3a3e093dabfa871b0aea8a704bda0bc52a98d61e9f2b49bcf10040c490ba0df1d0e17c975d557a7ca4ee0c02785f40b06e92f85ab43772a338c548b6ce0bdd444b277d2e08c460c1fcbe063f2bfbbb52065cdcbb564825e3aeb040402228aa70d3cc016fe55bfa618efb74b88f418b122efdf6fa5db36b49ae8b12e8c1c5c16e79eba08da33d3aac8dd6cdc4de60daef063b5533878f2bd4f5cb6f2e62b8794e385882aa1a115aab028f0d224ad60ab27f511cd146d3eaa0e719c7147776f10b8ce268856281f3a07913da636fabfda5ddd3c86be6d7b696c2672f1d394b4c0277dffb54615186369148e096fe99b190b5439474f0214dcc6ec045284fa009eb6626eeee222cb41fe17524277f16535f407b5999be690d807f484a9b4ced78813fc76f590cecf9d643ca1893f506d09c2e5a5a3d9a24e3cd91eae7b747b633f1bf6e63980b95c8eeb0416ad49fabaf1c935c463fee8e65a1a462085b80a8121a301cd5bcc833826b1058f540c63e7455c980941428e3ac295326e86028e2cf87ee6b38f51ce5f191c9256237ada54494b641ac9d26d600821e7d3b121f952dad4047358a34b3a57d67c3c7726c17029af3c21d53a55c55ea2380e84ea65f103c4e5f3cbd8b6fc53bb87995baf51e30f6ea68a9eb73075a5400c03fbf81f26a5be1f0208adbf8e70b4b966bf0b9b82e8abf7058a803a080092bbc55ad4b4d9efcccb596d33e5ac881938d4dfd7ee657ba191889c441d37530038e71889cf048119b62974ed0a37a492bb1e9bbd715fcbfd77183219ac2246f6d98050bb260b54b5c1bdfc677d9b89f9e28f77ecaa321375dc6cd99cde0c9551ef5d1ac04b37be95b9c9af13975aa708c2fd353358b6d3db3063a75e812f0746c501c85fad33044374617f169a2605018602861bf69923e1ae6c5ec2c8e89295611db31428bea8fbc336fb4628698fc4125bd660edae833091c038cd25a97532da804e99b1688d667f53103ae9fbee3e59738778f31723e3945599971f6b973c6cb62567fb78caae18bf54c28adb4e72ace841d1f5ce271963724a81906ccddd6bac4cea9320666e3421b73b95e4c829839dea08455ff1e4ee886dda629fbb09a5aa2c47370f2e39d829deb463473ef44def2e133999626e464ce7e2686393cb15bce22072318749ed3c5e47321f8b5b74d2f03a564f16a8ff18fd0e8c4a52760e450471ed38f875e4bb4efc682ffabca421d51c25812bc65b435585b46f529b8d6ca1f40ae0dad0422604761e1e9343e85e4128cca705e9e9283b2154c6ff13b00177017f25a52ac7d7fd081f47d3a6bc1e57bdcf2a77dec03735d42c8283c5e49803d0f20f4184fdfd9cbc055c6a7ab22e8ca280f6b5257fc0959e75ac9110acef8605a5fb960a9713b757f6287829829020ffcc44c43eb8e291b232830d26566e1a3b34c0a22b9cbc2585bbf8334a19e2d31e6accdf9290096c0cf0e4870038087840094914e7d8ba6114c6b64b32a301598e2a366dd4b466d11f3a08873af839e74d39ef4781605eea9760d9285d31c4c87da35aed8e5f67bc885f32b23720dfb7a504361bd2026c4ce2ab04638b5ade1cf2d758ea99fe70ff5c23bb3033a3ccab9420b69ae1ffc0306fcd59021daa191a2353d6de41e8843fb09865056cd439097734116cc7a7e58fa8bceeb0e1a337ee113382ab7197a174db14b4a9b303d6dea2e58dc021a86f5acd3ed38b46c319db6c97d5da81f8a55c1ddb1c932f8c8a8e39e5853a3986eee72fc47abe172332fb7c9ed9dd4476e5e6704098cde93745a449be65409775a438ba2bc2472f822cdef7e9b80133fbc5895b3f212b1dca588c8476e8235ef5a0344608df22d083bf817b672d2cb93d724170805df2b7e8c86954f6f4d4868419395bea788b34233a1bdd1b50f8bb03bad08b042ea683f97ebf5bae09c921b006a3526d276c35d51ae80cf5061afa6a7036bf72660e1935772553f1f592b2b3dd3552a362af7e22c1efe53d8314d12ed7a298d3612417da9c398c64db10cb7e36db61c013c08a4fc4636fb64aba6bd0a4e41bf30f54cf26a7a9db5a3c08803cd6addd0b1f615dd4d8f3042411441b74fdf50f3c916f08b3751de64d62b62ca7fd1b7a2c6e607b7dcda34ae0eb6f2351c2104bf6b39e6e289a346aa243f4a52c63fe05c8144f79f79f037374364400ceab88653cbf982bb7960dd1073b4cff3188818ea799abed4c570b0d7b3c1d931f8b3ea9f299ffcfb009b537670d27c3dce4da47a90887854819c83599cb338d6915db7bdee7aed1a23d7550adbd8c956729309c734778b076dc8d1a188dac592b1c139436f427944e4d5ae14619edf3a4cb950d65cd98a11a8ef55f8a6fca572984ec7f5b3a9da7a80a1f19c485048520197f1361fbbe55dc9319ece7525970332acf3aa4825ae159f7797795c22cbcd82d979f10569abf9d43aa713434c607013c32d1983b43152a807d13bacf0333eba56db2583eaf1921dd9871bd2ba49eb0e7bda3df31db34a48734d75c5db31718d17acd2aa7a531a606bb67fd4dc58c56914f12ca71d74340c631e8f13467ec701978b738b8065b4592f295a6e1bd35948da66cab3ac92877ca80e092b565a481f6baf324b0b122f2ab7654014441aeb9b3651ae066e1becaec63769aea52a93191c0073e261730fe71255f18aef1885af0747fbdae553308f35104024beca1f96f521c7369c4ab43dfc8c20e72d32b65f64c156b6875816983e3fc446ee64e7062e0d6e7d66ec0e1c3e73a7acd30084000948332188fa7d48beeb7f6a0740976d68d3c5200b82ffc31f47e8db0cc872d1edd09f52e7fc026b297ac66c6f779d4469ed63447a975e70a65aaa6df90321b8e3e41138c4679a56b69fd4cdde722d58c598db79fcc1b0917e6eb2216b983bc0cfd7ddc8f76cbe94fe205a405ddf262f47e4a222bdfbc2c33da660a454fdcea6518a54897c0c9c0637930085d1e5532bff7c2db0bb636e61b1571dc01e8b7769232a1b6b31ed9cd2716189805f96e02a7c93d3f2fd0e95dce5fd7bcdefb1144c9f70cc6d651cec70c423c9a55ae3300ec8f1c09599ba19a0400dc401feefc2d381954a6732974a4f9072fdf3636a010304de52de2edcd9b31b98db787fc5f644bdecfce96b810fe571484e80752a731709d17caaac8f67461a60745a2f9af158a6ab4208995067d57234a886ba46142b21c42d79dcf8a5f2c02220c312e110ec0b5ea00d1ef517ff6242a3fbb64c04b9a91a04cc1e2230cbf48414fa64e1a5da4b6fe0012812602729f8cbd4ed391b1439c0dd4673f040f83b1264a6a0cef2e95c606757540fa3c995795250d892b82482770e3f7a0e29758d5265bbcfbcf4ce053d704a6306ace1af271cf8f18f198e16f6d595be4b4e0789f03665d82400f51ca83bf166321bf8fb7410c14cb6b2abd812fc4cd21a751b991f91e479b42b0a7492a56c282037c2af49391a5c470f2d83b3e0557962c202b4d087410d4f063855b2e4c0fa1b8a9feb854680a213de134431ce5d5c7b68223b62d23e98fad97a5e05ac62fedd1e9d565a8532244e30e77a6ee1df524d8e6362921bd6b970a678ed787ab5d2f390e33185690f28f9e73ef97adc07f92d1255720aef76fc3a4c0e01dd3b8cc79b6befb773ee1b3bfc4e0dae118feb8328d5806e11d3d79d5f0a08e5d912c442765c6a73027ed31e3e135bd6c0a5e2eeb2804a243fe64c53fa4b9c0993b0d3a61464df146220442dfd14b966e1b76c0c14982b50624888912c4fe865f3bfcc027ce04c28e3309344ff5448d9becbf8ec29f6589f5c1965bf1a5c04362c9c78586e20adae9aa562caccdf2b87a24261d09682e819cc0957a6d3b033589f1e1242153433633e51e6d8ee7a83cb29a4e2cf8ff8709d66523532b75f7e83119e337a48eb2d4504072d21c909a26c1f9b451c177d5eab1a5c8322e621b27dc5d614769d9d1fd55f857f41ba74aa573f57a991aca6ac7c0dfde8d41e3da52af56447880812839ec18a64a16f5255e07e88e71b2fe186502bcd1db62d55f5b9f019283ceafd48b417988e1db28b2ccc1253efbce8681d8c94c691b52e2b1fba77cdc4d806b2e28dc83a9d9858b3f5b60d60cef5d7e05963295d8525d2d7602846e2df7e6d3bc1241b3735c1ac4089a9423932bc43751b5e8c8ad16237e8b0a941151f0890f38bd1f1acf1f8773fdf7c446c178782e4ae001455751ebe9be469f8eda6677c78321035c4fae7bf62c72a2d34dd5e911dbe2499a3290ad9e3962b071a0b15ea88f4e4ad289eece5623791805d714df063854cd6e981e14dd47e34128bc36654d92da8e435b9cb3214a5655d1a4f76399f52f05ca092ce47f3ca5c3c0051c41b4b9131c28da0fbb33182d7f952c0c2f12a4ee571ff225f7beab15b8ce087c53acd38e1d55ef16be615cf649bcf6c76cb4d5fdad0ed51ffc42b79a547c725e34dcc9aa3f6a3ee8a9d6d2499977fc6f1ea5c25ed7c3f37d8e567b5d3f19a286a61c797cc5145998274e0")

14:03:47 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd004000000000000]})

[ 1738.729094] binder: BINDER_SET_CONTEXT_MGR already set
14:03:47 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14000000]}, 0x2c)

[ 1738.763692] binder: 12652:12654 ioctl 40046207 20000100 returned -16
[ 1738.816033] binder: BINDER_SET_CONTEXT_MGR already set
[ 1738.834205] binder: 12652:12667 ioctl 40046207 20000100 returned -16
[ 1738.869916] binder_release_work: 11 callbacks suppressed
[ 1738.869921] binder: undelivered TRANSACTION_COMPLETE
[ 1738.895185] binder: undelivered TRANSACTION_COMPLETE
14:03:48 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x31, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5e"})

14:03:48 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x15000000]}, 0x2c)

14:03:48 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:48 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd901000000000000]})

14:03:48 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
getsockopt$bt_hci(r0, 0x0, 0x3, &(0x7f0000000080)=""/169, &(0x7f0000000000)=0xa9)

[ 1739.439593] binder_thread_release: 10 callbacks suppressed
[ 1739.439600] binder: release 12642:12644 transaction 375 out, still active
[ 1739.483410] binder_alloc: 12642: binder_alloc_buf, no vma
[ 1739.500010] binder: undelivered TRANSACTION_COMPLETE
[ 1739.509340] binder: 12674:12682 transaction failed 29189/-3, size 0-0 line 3035
[ 1739.523623] binder: BINDER_SET_CONTEXT_MGR already set
14:03:48 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18000000]}, 0x2c)

[ 1739.535174] binder: 12684:12685 ioctl 40046207 0 returned -16
[ 1739.557111] binder: 12684:12685 transaction failed 29189/-22, size 0-0 line 2896
[ 1739.568723] binder: 12674:12686 transaction failed 29189/-22, size 0-0 line 2896
14:03:48 executing program 5:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000022, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
r1 = dup3(0xffffffffffffff9c, r0, 0x80000)
ioctl$KVM_HAS_DEVICE_ATTR(r1, 0x4018aee3, &(0x7f0000000040)={0x0, 0x401, 0x2, &(0x7f0000000000)=0x4})

14:03:48 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe006000000000000]})

[ 1739.591921] binder: undelivered TRANSACTION_ERROR: 29189
[ 1739.604394] binder: undelivered TRANSACTION_ERROR: 29189
14:03:48 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
r2 = syz_open_dev$admmidi(&(0x7f0000000000)='/dev/admmidi#\x00', 0x3, 0x61ae01)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, &(0x7f0000000080)={0x6, 0x1, {0x1, 0x3, 0x1000, 0x3, 0x40}})
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:48 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1739.644025] binder: undelivered TRANSACTION_ERROR: 29189
14:03:48 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x31, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5e"})

14:03:48 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f000000]}, 0x2c)

14:03:48 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
pipe(&(0x7f0000000000)={<r0=>0xffffffffffffffff})
getsockopt$inet6_dccp_int(r0, 0x21, 0xf, &(0x7f0000000040), &(0x7f0000000080)=0x4)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

[ 1739.775905] binder: 12704:12709 transaction failed 29189/-22, size 0-0 line 2896
[ 1739.826152] binder: undelivered TRANSACTION_ERROR: 29189
14:03:48 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:48 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff02000000000000]})

14:03:48 executing program 3:
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r0 = syz_open_dev$admmidi(&(0x7f0000000100)='/dev/admmidi#\x00', 0x0, 0x240)
ioctl$VIDIOC_SUBDEV_S_FMT(r0, 0xc0585605, &(0x7f0000000080)={0x1, 0x0, {0x9, 0x7fffffff, 0x3007, 0xf, 0x9, 0xb, 0x1, 0x6}})
ioctl$CAPI_MANUFACTURER_CMD(r0, 0xc0104320, &(0x7f0000000000)={0x4, &(0x7f00000001c0)="2f0c736e82b9fcf058d189f948a7a1de780cc842981afedf07cf036dfae677e0e0a62b3b47345cd9b6584be717c29a6ffbc6d76999768ae06f50059ca2c16b86108621f98138b6abc36511373a7de46e"})
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000010000000000000800120000000000000000000000000006000040000000000000000000000000fe800000000000000000000000d55d46dedfa971cd0000000000000000000000"], 0x50}}, 0x0)

14:03:48 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe4ffffff]}, 0x2c)

[ 1739.936863] binder: release 12718:12719 transaction 387 out, still active
[ 1739.955731] binder: undelivered TRANSACTION_COMPLETE
[ 1739.969068] binder: release 12718:12719 transaction 388 out, still active
14:03:49 executing program 5:
sigaltstack(&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000000000))
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x8000, 0x0)
ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f0000000100)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e24, @broadcast}, {0x2, 0x4e22, @loopback}, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000080)='bpq0\x00', 0x8, 0x5, 0x3})

14:03:49 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1739.991908] binder: undelivered TRANSACTION_COMPLETE
14:03:49 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000]}, 0x2c)

14:03:49 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x7ffffffe, &(0x7f00000002c0)="438f997962ceee8269909d336b4d5264dff6c60e0c34ba68b170962023e4a47870415c87f724b3ecba92c435f1e77abc6d336a463c6f7f6ec0e652687faa65da805ff21f77003dcabeb94db5741d1b2a0a3541da2b3e4b1a916dbfa2f8f952536be69a405c91dc96d315e39ff02584c8ec218bdbe2dca7ce3446f6573a9e647773afbd85d5b19b9ec8ffdc8e1131abda3020d2f9b144602ee6b60503e666a959e41e3d2ebbc0540dbbf0fc656eb1a311166835cf04597b0f083853a194c4d7a0254cb78c240e1171c5cf28b8781931d43606b3d18018226ec991713f63cc56fdda4f72409b92f4e3716b9abd2ebe7ef7d98aebeb6c03b906dada819aafa6e714d25b44b6fd7993b0bc0cccc80be5cb1c94ac732133edc6154140fd8f026ea907dc2d8e53f6f22ea8c7e8597f525d7ff0bd40e71c06cadcb812218f6c69f3986383a0195977835f0defd1ecadf61bc3d8736842bf31ccdd892e72000613ae03f499355ef4df91be39c8501669a441090786a879e7ad8ca51282e28a9dd60645a264697b6e3c08e3")
write(r0, &(0x7f0000000200)="3c976f8d02cd7db15fe09d64fc4c231e8c3415049d6cd19c4d7f7b356716391c96c0f195492a8b66089a380b5b3ca5bc3e209e04cead69d811a8ff5db466d456f430c637ade18c05f7a6c6c4d763a6e5ca7014e9b791e43cdc95279fbcfe72e3a9f3f0e52efc723b7d4b2986112bd84738853fd812449624709d34d1e89953c7222ad17939f63683", 0x88)
r1 = socket$key(0xf, 0x3, 0x2)
getsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000040), &(0x7f0000000100)=0x10)
r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x20000, 0x0)
ioctl$VIDIOC_DECODER_CMD(r2, 0xc0485660, &(0x7f0000000180)={0x1, 0x2, @start={0x3}})
getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000600)={<r3=>0x0, 0xfd}, &(0x7f0000000640)=0x8)
setsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0x14, &(0x7f0000000680)=@assoc_value={r3}, 0x8)
getdents64(r2, &(0x7f0000000500)=""/204, 0xcc)
getsockopt$sock_int(r1, 0x1, 0x3b, &(0x7f0000000480), &(0x7f00000004c0)=0x4)
ioctl$SCSI_IOCTL_DOORUNLOCK(r0, 0x5381)
sendmsg$key(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYRES64=r1], 0x8}}, 0xffffffffffffffff)

14:03:49 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff0b000000000000]})

[ 1740.076091] binder: release 12736:12737 transaction 389 out, still active
[ 1740.099733] binder: undelivered TRANSACTION_COMPLETE
[ 1740.126357] binder: release 12736:12737 transaction 390 out, still active
[ 1740.157012] binder: undelivered TRANSACTION_COMPLETE
14:03:49 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x39, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a"})

14:03:49 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:49 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffe4]}, 0x2c)

14:03:49 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)

14:03:49 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
getegid()
r1 = socket$key(0xf, 0x3, 0x2)
openat$ashmem(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ashmem\x00', 0x800, 0x0)
fcntl$notify(r0, 0x402, 0x0)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=ANY=[@ANYBLOB="02000000120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000876cf2707f20c27648a68cee82f222e6af250cd5c0723112561b5ab4cec541a5d2625a195243df22cb0c4261f0763c56420ded601fa93bdefefd3804d815f18625aaa8197b4934b525bd9e624e9252cd2a1ac392137fec837c3c71184328e0a286a1a23ac93a476216461bbd9ff97b264c551a52412626df463aae1528a6be145879402150b6d55e30d16dc95d6396972dc358fff367bbbf93c280096faa14fdbef981dbf958c61b065b3e4c978967d9cf9816e0cdd148e4877d561f2312eda02d21b400000000000000000000001000001a81b1cf1621180c24fa2a9bcac01ae332e61986fc4ac196232df188c8000b3680ba1d6461f080d65da3ef0f45edcc4cf5ad7c98365940a727823e8baadf1f57ff8d2dc1a3c647866efcab758c4a5138b1219a851aabb6d5315c3f42a1fb068a1d5fa6393120b5793cab12b8b4fcf27ffb8161865b5df8c9a4022b54b18d15ac6114277725cadb29d219220ac180dbc667d2c787942e61fe67b9e452aa35d9e9d2b7cfcb2da1d2d47f6e7282c17add191a2b1a02842a53cf253dfba2826c1cd6854b06"], 0x50}}, 0x0)

14:03:49 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]})

[ 1740.600045] binder: release 12706:12707 transaction 385 out, still active
[ 1740.607103] binder: undelivered TRANSACTION_COMPLETE
[ 1740.617333] binder_send_failed_reply: 8 callbacks suppressed
[ 1740.617338] binder: send failed reply for transaction 385, target dead
14:03:49 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000]}, 0x2c)

[ 1740.668676] binder: 12755:12760 transaction failed 29189/-22, size 0-0 line 2896
[ 1740.698148] binder: send failed reply for transaction 387, target dead
[ 1740.709854] binder: send failed reply for transaction 388, target dead
14:03:49 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1740.728655] binder: send failed reply for transaction 389, target dead
[ 1740.755592] binder: send failed reply for transaction 390, target dead
14:03:49 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000000]}, 0x2c)

14:03:49 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="021600000a000000000000000000000008001200000000000000000000000000ffe42ff400000000000000000000000000aafe80001a6602003b4fe8df985ef334e1153266"], 0x50}}, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'teql0\x00', 0x8000})

[ 1740.774886] binder: release 12755:12760 transaction 395 out, still active
[ 1740.794963] binder: undelivered TRANSACTION_COMPLETE
[ 1740.830205] binder: release 12775:12776 transaction 397 out, still active
[ 1740.858327] binder: undelivered TRANSACTION_COMPLETE
14:03:49 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:49 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]}, 0x2c)

[ 1740.873824] binder: release 12775:12776 transaction 396 out, still active
[ 1740.881322] binder: undelivered TRANSACTION_ERROR: 29189
[ 1740.933168] binder: release 12786:12787 transaction 398 out, still active
14:03:50 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x39, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a"})

14:03:50 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]})

14:03:50 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}, 0x2c)

14:03:50 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$EVIOCSABS2F(r0, 0x401845ef, &(0x7f0000000000)={0x600000000, 0x57, 0xd0, 0x0, 0x2, 0x2})
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='net/rpc\x00')
ioctl$IOC_PR_REGISTER(r1, 0x401870c8, &(0x7f00000000c0)={0x8, 0x1f, 0x1})
r2 = socket$key(0xf, 0x3, 0x2)
mlock(&(0x7f0000ffc000/0x4000)=nil, 0x4000)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:50 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:50 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000000)={<r0=>0x0}, &(0x7f0000000040)=0xc)
sched_setattr(r0, &(0x7f0000000080)={0x30, 0x3, 0x1, 0x0, 0x492, 0x88, 0x5, 0x7}, 0x0)

[ 1741.522497] binder: send failed reply for transaction 393, target dead
[ 1741.529579] binder: send failed reply for transaction 395, target dead
[ 1741.559779] binder: send failed reply for transaction 396, target dead
14:03:50 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}, 0x2c)

[ 1741.580038] binder: 12802:12807 transaction failed 29189/-22, size 0-0 line 2896
[ 1741.590218] binder: send failed reply for transaction 397, target dead
[ 1741.600129] binder: send failed reply for transaction 398, target dead
[ 1741.613414] binder: 12802 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero.
[ 1741.613426] binder: 12802:12807 ioctl c018620c 20000100 returned -22
14:03:50 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x35, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a0000001b0000000000000008871d0000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
ioctl$FITRIM(r0, 0xc0185879, &(0x7f0000000000)={0x1, 0x6, 0x9})

14:03:50 executing program 5:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$FS_IOC_SET_ENCRYPTION_POLICY(r0, 0x800c6613, &(0x7f0000000000)={0x0, @aes256, 0x3, "355416ce092a6f73"})
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x0)

[ 1741.652809] binder: 12802 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero.
[ 1741.652821] binder: 12802:12813 ioctl c018620c 20000100 returned -22
14:03:50 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]})

[ 1741.717736] binder: undelivered TRANSACTION_ERROR: 29189
14:03:50 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}, 0x2c)

14:03:50 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:51 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x39, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a"})

14:03:51 executing program 3:
openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x400000, 0x0)
openat$mixer(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/mixer\x00', 0x2400, 0x0)
r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/sequencer\x00', 0x1, 0x0)
r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000300)='/dev/null\x00', 0x8200, 0x0)
ioctl$ION_IOC_ALLOC(r1, 0xc0184900, &(0x7f0000000340)={0xfc, 0x8, 0x1, <r2=>r0})
fsetxattr$trusted_overlay_opaque(r2, &(0x7f0000000080)='trusted.overlay.opaque\x00', &(0x7f00000000c0)='y\x00', 0x2, 0x1)
r3 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r3, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r4 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB="021600000a0000000008001200000000000000000000000000060000400000000000000000467134115e4c85960000000000000000000000aafe800000000000000000000000000000c26b390a7dc08b5eecbe7c73"], 0x50}}, 0x0)

14:03:51 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000]}, 0x2c)

14:03:51 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:51 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10]})

14:03:51 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000]}, 0x2c)

[ 1742.472261] binder: 12844:12847 transaction failed 29189/-22, size 0-0 line 2896
14:03:51 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000]}, 0x2c)

[ 1742.519371] binder: undelivered TRANSACTION_ERROR: 29189
14:03:51 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11]})

14:03:51 executing program 5:
r0 = socket$isdn(0x22, 0x3, 0x27)
getsockopt$sock_int(r0, 0x1, 0x7, &(0x7f0000000240), &(0x7f0000000280)=0x4)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x10000, 0x0)
getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000040)={0x30, 0x8005, 0x3f, 0x7, <r2=>0x0}, &(0x7f0000000140)=0x10)
setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000200)={r2, 0x2, 0x200}, 0x8)
ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f0000000100)=<r3=>0x0)
write$P9_RGETLOCK(r1, &(0x7f0000000080)={0x1e, 0x37, 0x1, {0x0, 0xad, 0x3f, r3}}, 0x1e)

14:03:51 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306203, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:51 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
r2 = syz_open_dev$vcsn(&(0x7f0000000080)='/dev/vcs#\x00', 0x2, 0x2000)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0x400, 0x101100)
connect$unix(r2, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e)
ioctl$KVM_X86_SET_MCE(r2, 0x4040ae9e, &(0x7f00000000c0)={0x100000000000000, 0xd000, 0x3ff, 0x8, 0x6})
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[]}}, 0x40000)

14:03:51 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000]}, 0x2c)

[ 1742.669060] binder: 12864:12869 ioctl c0306203 20000100 returned -22
[ 1742.705725] binder: 12864:12873 ioctl c0306203 20000100 returned -22
14:03:52 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x3d, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f"})

14:03:52 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x3f00, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:52 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12]})

14:03:52 executing program 5:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fsetxattr$trusted_overlay_upper(r0, &(0x7f0000000000)='trusted.overlay.upper\x00', &(0x7f0000000200)=ANY=[@ANYBLOB="00fbcd010066921c393b5f00c1609916b28272179972fddfda317669909607247732a1b7020077388d5cf0e318bb9c6f974581cb7446e3a0401d776c982a54015c9be060d03d66ac6a1350bd7d8a9253034495e9a6c1ecef988753ce210cf0e3e84c6d48b1d15e30ba6354d792ff5edf2a384e14559bf9215b13144cf5161ffd6b881f2ab90fbd0400bdcb0ceea6531d5fbe3035adfc48e6bbec68cb2aa6e7d22500e324d978d2111f86db93d7db35f25565461a22f56aefb283934c8447bbd9c2ea112038907a"], 0xcd, 0x3)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
r1 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000040)='/proc/capi/capi20\x00', 0x80000, 0x0)
ioctl$VIDIOC_LOG_STATUS(r1, 0x5646, 0x0)
getsockopt$inet_sctp_SCTP_CONTEXT(r0, 0x84, 0x11, &(0x7f0000000080)={<r2=>0x0, 0x100000000}, &(0x7f0000000100)=0x8)
getsockopt$inet_sctp_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000140)={r2, 0xfffffffffffff22d}, &(0x7f0000000300)=0x8)

14:03:52 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000]}, 0x2c)

14:03:52 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
fsetxattr(r0, &(0x7f0000000000)=@random={'trusted.', 'selinux\x00'}, &(0x7f0000000080)=',eth1)vmnet0vboxnet1*(+vmnet1{bdev\x00', 0x23, 0x1)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:52 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, 0x2c)

[ 1743.383534] binder: 12884:12892 transaction failed 29189/-22, size 0-0 line 2896
14:03:52 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
sendfile(r0, r0, 0x0, 0x9)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:52 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1b]})

14:03:52 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000]}, 0x2c)

14:03:52 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x1000000, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:52 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
r0 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x1f, 0x1)
ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000040)=0x7)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:53 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x3d, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f"})

14:03:53 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00000000000000]}, 0x2c)

14:03:53 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x80, 0x0)
ioctl$VIDIOC_G_STD(r2, 0x80085617, &(0x7f0000000080))
getsockopt$inet_sctp6_SCTP_STATUS(r2, 0x84, 0xe, &(0x7f00000002c0)={<r3=>0x0, 0x3ff, 0x82fa00000000, 0xff, 0x9, 0x10001, 0x8, 0x20, {0x0, @in6={{0xa, 0x4e24, 0x7a, @loopback, 0x1}}, 0x800, 0x3, 0x8, 0x0, 0xffffffffffffff00}}, &(0x7f00000000c0)=0xb0)
getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f0000000380)={r3, 0x8e, "1fe4f5a66393e0053d101221f893ea145dc0d504db90254987a36af9012bb6063886513cf12280c5a47173cfb0d57f4ffe235999bb6a3e0cad8108128b68c1d96d6f43fe3570b3c12eaa28dd5ef3b026435725a24b806a4070e7b8c6f6235201a6470b69e4d802381223122681316a387713381357d6231a7d9f20886ae05a474be767a039c71b67840f7dcbc6a8"}, &(0x7f0000000100)=0x96)

14:03:53 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x34]})

14:03:53 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f0000000000), 0xa, 0x0, 0x0, 0x0, 0x223)
r0 = syz_open_dev$sndpcmc(&(0x7f0000000040)='/dev/snd/pcmC#D#c\x00', 0x7, 0x121000)
getsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000080), &(0x7f0000000100)=0xb)

[ 1744.179242] binder_release_work: 13 callbacks suppressed
[ 1744.179248] binder: undelivered TRANSACTION_COMPLETE
[ 1744.198931] binder: send failed reply for transaction 419 to 12914:12915
[ 1744.220111] binder: 12914:12915 transaction failed 29189/-22, size 0-0 line 2896
14:03:53 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00000000000000]}, 0x2c)

[ 1744.252291] binder: undelivered TRANSACTION_ERROR: 29189
14:03:53 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x3f000000, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:53 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[]}}, 0x0)

14:03:53 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a]})

14:03:53 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00000000000000]}, 0x2c)

14:03:53 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}, 0x2c)

14:03:53 executing program 3:
r0 = syz_open_dev$admmidi(&(0x7f0000000040)='/dev/admmidi#\x00', 0x5, 0x100)
connect$netlink(r0, &(0x7f0000000680)=@kern={0x10, 0x0, 0x0, 0x3000800}, 0xc)
ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f00000001c0)=0x2000000)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r1, 0x1000008952, &(0x7f0000000100)="0adc1f123c123f3188b070")
r2 = socket$key(0xf, 0x3, 0x2)
ioctl$TIOCLINUX5(r0, 0x541c, &(0x7f0000000280)={0x5, 0x1f, 0x0, 0x3, 0x2})
sendto(r1, &(0x7f0000000000)="6a7faf52c6e9264beb0794195c", 0xd, 0x10, &(0x7f0000000080)=@ipx={0x4, 0x4, 0xffffffffffffffff, "0d22684a3112", 0x401}, 0x80)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYPTR=&(0x7f0000000200)=ANY=[@ANYRES32=r0]], 0x8}}, 0xfffffffffffffffd)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000480)='TIPC\x00')
sendmsg$TIPC_CMD_SET_NODE_ADDR(r0, &(0x7f0000000540)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x3d30a7afae9dd057}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, r3, 0x420, 0x70bd25, 0x25dfdbfc, {{}, 0x0, 0x8001, 0x0, {0x8, 0x11, 0x6c3c}}, ["", "", "", "", "", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x20044845}, 0x41)
ioctl$DRM_IOCTL_AGP_INFO(r0, 0x80386433, &(0x7f00000002c0)=""/141)
getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r0, 0x84, 0x66, &(0x7f0000000380)={<r4=>0x0, 0xfff}, &(0x7f00000003c0)=0x8)
setsockopt$inet_sctp_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000440)={r4, 0x1a4, 0x80000000, 0x401, 0x80000001, 0x2}, 0x14)
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000580)={<r5=>0x0, @rand_addr, @broadcast}, &(0x7f00000005c0)=0xc)
bind(r0, &(0x7f0000000600)=@xdp={0x2c, 0x6, r5, 0xe}, 0x80)

14:03:54 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00000000000000]}, 0x2c)

14:03:54 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3b]})

14:03:54 executing program 3:
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:54 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x3d, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f"})

14:03:54 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
clock_gettime(0x0, &(0x7f0000000200)={<r0=>0x0, <r1=>0x0})
futex(&(0x7f0000000100)=0x3, 0x8f, 0x2, &(0x7f0000000240)={r0, r1+30000000}, 0x0, 0x3)
futex(&(0x7f0000000000)=0x2, 0x4, 0x0, &(0x7f0000000040), &(0x7f0000000080)=0x1, 0x1)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

[ 1745.044955] binder_thread_release: 12 callbacks suppressed
[ 1745.044970] binder: release 12933:12936 transaction 422 out, still active
[ 1745.057976] binder: undelivered TRANSACTION_COMPLETE
[ 1745.072568] binder: send failed reply for transaction 424 to 12944:12948
[ 1745.083118] binder: 12944:12948 transaction failed 29189/-22, size 0-0 line 2896
14:03:54 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000]}, 0x2c)

[ 1745.196799] binder: undelivered TRANSACTION_ERROR: 29189
14:03:54 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0xfdfdffff, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:54 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x0, 0x0)
ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000100)={'dummy0\x00', &(0x7f0000000080)=@ethtool_ringparam={0x11, 0x6, 0x20, 0x8, 0x2, 0x800, 0x6d9, 0x6, 0x8}})
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x80, 0x0)
setsockopt$l2tp_PPPOL2TP_SO_RECVSEQ(r1, 0x111, 0x2, 0x1, 0x4)

14:03:54 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/capi/capi20\x00', 0x80000, 0x0)
timerfd_gettime(r2, &(0x7f0000000100))
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYPTR64=&(0x7f0000000080)=ANY=[@ANYPTR=&(0x7f0000000000)=ANY=[@ANYRESDEC=0x0, @ANYRESHEX=r1], @ANYRES64=0x0, @ANYRESHEX]], 0x8}}, 0x0)

14:03:54 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48]})

14:03:54 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1100000000000000]}, 0x2c)

14:03:54 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x20000, 0x0)
ioctl$KVM_SET_NESTED_STATE(r0, 0x4080aebf, &(0x7f0000000200)={0x2, 0x0, 0x2080, {0x4000, 0x16000, 0x3}, [], "13745f8e3ce5407323cfb981e79b43a7ef23e4cb6a2ca70684a7a9c794f0273f0338f87041a653056cfd9b5396b67bbf783465ccde95128f6f175db4736dc9e3204c19fc112939eefee41bfb56a30379b3b610cedccc57f0ab9e43b47ce781ea1c1315f84be0868b0f3f0fe4e808e337eb0403840ad84c9a008eac7c1e3e2c829dba6270c034e3c19ccbb9d4fc1f3f31b73e0e8bf708abd36218e403ecc2ff5d24dbfad52dd1a648086a2ce3c444e8872a798bed508814e50e0262ee162470c1fcb37ca68d0bfcd7fa09418bea0e55d92d6c44c24b97de7f078e2b8d728942d63863a7de83f7f37b89c245a01bcd718f04c2e6e84586d17eada9d61854559116d491e865903249dbfa48a8b2facf7aaee0aece11602003ac64f5641f93aa229bdc2e04915714a37959847f9bad3047f31f238babe48aba31ba794b0f4a5ab339ecee9297650f2fe0a0cdae4349434701e3aec79ea36e9a86814de3f186d8878ceb6787ca770376ce230aa29dd497738841d546dfd419bf28367fbe0ac338e9d11bec6e52b4fa0647814969eff00001ddbc38fb4e4201c8b48bdaa4d24523d0b1ac9c7419f6f91bc3c34874bf95f3f6c504d47609fd8726830315c035671c05b43c9a2ec840c92e8f7d3e2c8afb9b55a20543baa1cd022109c5c117bb77fe65d5b783b75025383f0afc3e5047a5fd881dede9b701b2bae0d8ccd8afae53b1a185d4d6f179913be2504d4f3bb3cd3c8f5a815ae563e6e6de1bb35a4afe40b5499261518eb62e9cf037e406c6e13347e13bc8ec0c9c95f20a077a6e025383774d3c2b9d16798a6f815ad840b982c241e50610c928bcf7630fe3136c588390712f5a76423d0484e3e1bd563acfca8cca7f76b0d032f1f71e09fa75cdd1368dfcd676c139458785281e2b26d1d354c13ef8610581b84de7c689755edffddc5cb9e3222ad5350c777cf0c699a7d6fb76489c8368bd6a50e64eeac66106fcf1a716dd13d919cdc2ea831335c312faa83d4b53f1b93f1f38a08d642f1e29ba4bc8271df25c68b37ad6b1c3bdd47e9614dab7301d13c60eaf59d10ba122e0423d09a45aacf8e7bee5d35903e942f8bc74f33b39ccfe60c44101a521f153af3d51d83dfe8b0efd01736ee2bdd924f5e5340c968e77fea614da4e0c1cf7c51094396b761e199e70cb8f94896e93c9c00f1e21f50651ff11855cff5ced2f03af590dd75357b997f92eb8ee413f092cbc1f52520b1f100944549d24889046b3ba596374ae665ca5b4618a069b98637ff5697e67d5eff5994ce429114059d9a471e11daf7478e55098181d5c17a72a430d22461fa3bbc7d0f174d87a110271147c995dd3fdd588ebf087e2535c1c0dd004a4d1881a9f1ee81ff9a2dba9ac4ab5811dbde1271d6fdd2891d333a7d4e5788718ab4bca05d92b57b6f67c9e664f987951db38aa69dcb988df05a87494ceea97a0d730ff6a5f816ff1bc6dfadc07fe032e2490f9f075672c29040b30359e30803938ed2ddf03cec89ece7590ec839b3cb05d32726c46fab6f73a128d16193616573936f3930b0256727d4a75613b6c796f62cfc27adb28f18a1797e2ad3b7e3f63274a66aed8147d5c159fcd5cf26376bb5f079c9d816298fa833a15c0754d799b8daa55e92e48b151f77d10a212d28149ecf6b5121a93b0c66f98939a32195ef3a35e947a89ae785510816cfbba979b90b2b74ffe310a0df5f9bc5bce59ace4462628527485591ee27f015d5691dba23a32ce5e9160582ea77ecafad5d21b88d5dffcd98823f09575799abc1d33c4756374652fec2faf61642e726d65fff76f74c824d42ed19923d8c553923bf6d5e78848ee0e1343794e31dc3f80309f19f8ab6b6fe4eaa9b58665c992705f53c8eacb02600a203c6c8243747f394dc00131518b15628f800c0965500b1d2f39f9795361de91a08cf3c13b46d64e5ea43328ed629d098f793cec338cbdb8d300ebbb903b6448f2bcd615f0cbf75da780e849aac8f696139c287672498f570d8686e1b20603c96e889f1341e680eba36bd2e1a06ae1fd06122c190cc5cb86c29ee1726ccaf7b64e1282dc314351c0752776b6eee3bdd76007765eaa1a824da281130647bbd58eae193abba8e81a99c0d5874421a207be542bad3d58b9bf24d37a43fca6855374bed9bb09b3d29141e76041e7bc831820f6bd21243ade3f75de7a7c90cc47c5f95d1ac221052c2270a00cfa79b910628e2dfc6372f00d86ebcae52037b68c928c54c7d1475a98716655d8dae09617cd66e44c932278c013e588e639530d89367e3f4808ec0e0dc4a0ec19d09a50836148f121fce57da840b3555da7614c7d5b8d7ef7a565f13fbdf257038124f47d69444cc08574e3665be4e042bd98a7dd3a62dc0e521fb185d6a670449cdd1ae9fa97d571df11908b5be1260fe44143702d5cd82e03b630a4a778c240dd4499b630a58f628fdef2d111aeb3d99d3116f57f5b59c2a071e2e53042c3effbaf93f211bfbdf7cb8bb225f9bcac9257d03118571ad9e7db73acf04c5956ecd936a00519cefe6c51111a343e8cfc7efcd29a74d3165200ca171ef63a0ece8b5ec3b7f59a3a7fb638a4a0078979027cae35ab876ff3ee852a0bf1bb075bbee66ef616b2661baf455d47c0f5558e9a1a4d3e55fb47b99694adf750eb2d79e58055ad1b325d6550d86ce1b262a00096c10158e23f92748c6a702dc1bd2970526f5652cdbc624537347d0b2e83af1c451fee4d2755888980b843c8e9639fa9a4e2730e24bc3fcae2e817b770bca206e06abdef3ef87a9a24c8321b5767daba855a38d2a4e179bcd5141b3743ed5c7b79adfc6e80feff2261657780aaea2eb82f9b2348f90c8c93f7813912ba713c3ec849d0aeb697bb7f485d0a0c7132119c287f74f73a12155e2c0501e73977770ff8385f450198bc67e0804982556cf4b4b47334eab5574b331ec85f7532a044dd90e191a57e8c834854b971e08cbba0494f89c1d0d8b345c31f9cc282c4b0dfdad601e3147b6a2724f56b4e101952363ceedb010ac16e1c3d77b7b8e7d690600cf3621122f5e12cbb7f12fa720dd4d2410c913bba6945cdbf70f0dc613b47a9f45673a70cdf6048b60d097bd8a49fe905f41f008465f4bb6cd614dabb89fd49288fde3681975a3b7e13ead526c4345d8f1fb0040e739f416bbc20aeb0c4981a2f172dbc844f006ff7b37b7a0c7600e0b47ffad1f1ece9434be3e6da5be605ce0ffaec34cb25346e68a149a0ea989118ac826426ea97b02e90f1276e9b98cd1438ac0dc0b867676eee8d30bc328be1ef394fd57df9fc313d4bc9705f3c54661aa88e52a44ae035b3a5f6be3a415a62e207cc8c9124978f4c413f1f45230686774cdca759f2e82fcd1fabfa106e73110935c7b038841a94382591467c694458df32bbeaae9c7e94846e3e41cfd6de119f2e975125c8178f1bab71b7b79b79964ed4bdbac6e641d838bc449afbce1c42a367dac469bdbf467cf8fb6a503bcdf92e841f425e5680acae5200830b2ba7b7762fa8e58c51b3f5bf8c577fcb87886535f4502009e64e0514cdd62c4e6f6eee096d9e6d808a41b246a62c3186a88f251d25d36d47f8467473c40326afc4bf85af72f26efa598865fe5051b90011a73a97f817405465e3124b53592443c60372879a93e5df6599e1234403a867001fe85c68e64c43fdf8fb549fb141f00926821f4944b29a9e566cc8aa2630d1f4b397a0ab509c3a47bc530f949e4a2cb75618229fcb519e9304fd8ef925ade249e5eb20016e27f5391cd6fc19a6dbc9d1d5390c93a6efd563f3cac7a2379db7017722ee2f1029f7a3559bd87065e29744561ae09d5e7e8a9e99879c5858071dc07efb1d7a69bed9e528e76b71644a7a6a8e04361c5f214c1fc49ce9250ab96be2bb07c46a91b9078233dfb03e9f52f2d85c5ba641858bdb732c1bc484beb38e89b717e25fe0457a5feb8a6853b0a7092b48792a1245d3f2aced02e149d9dee239c209ae3e5128f092b3c4e4123b26dfc54605cab7a91b4fc805247e087307d4075f1da19ec74f692f6609d9d7bf7db4dd00ff9cdc63b83d30e63c4638868c9dd60ff4921a36787dc0d3c5d46af3c71b6986cb4423107787d2f8ebe400bc0de6c4846b50cfac8c0906fa73eb1b29e1df6e2bd52470d7eb20f16a5922c68906181d38f0e19be54a3ab599a66fbe6171df12635a2ababca14d8f33a1dc188faa069ecacd67bd44b77073ce67a74852687590d18831e42aa142f479610dfdb8e1b4bfc36d37f1070dbdcbb3480b2866d9904af35b355cbcb6821e114f8b22f656ed6c6faa2f63fb4c721c4b65d8091fb981aacb5a7fbd24490339a6678264be01e2d72476fd4a54a32972599b54e2cde40989f039385624dd7aa38873503c9207ae672a7bf91ad8b3029dcd1af25435c17743f5688b400c47daabe1acaf0509462644021e257049abb184a45a00495f35515d5cbe67848931d20625d1162523f3d8c3a41dc45b6365dc6be5443e3d2500d3e9360c05e3b48bf2a2e81eb8efc491e1ff56883e0bbd1be819edbff8d40879103ea0583a264d80e99121625196ee336692a904057a57f6e909e243367a62bb625db6ed6d330ee34a75705d60ccf534b25b7cf28aa00b20da5eca767ab3d981b389f8cf01dde1dc71b1957beb42c51eda076ce28a4685b35ad7b9eabff0048e9a438650478ee286eb0ca4e8bd30113d79ffa6e8d5e87bfe2e2b2111d9e7ae386b71db5b935d6ba1c2ee0e43c05f9b38c7c591b4a3ca102b5fad8339b2ef8e84e00ac2d1bc7fa6b3262eb9929eb007c34a2e5bd8c86b8586a7c535490060ac13716ebd2d306a443b579e8786a3d928426e13660afdb8ad79c385ca09e4514c02b91ec86ed46d76b22de28f634cb145fa073307d8abcd331eba58acc1f5776c796ee2fef364a1c4fb4bcf5533f77e60a55020323373709fcb40bc56f6cd445d099cec5eed2716f1dec9e1f5c744f2884880e7c807bd1abf17ea45e95c788aadd4a2de31a062618b2c1245b8ed3c03baf19fec7ada6be7271c920b5805394db4a5303e62969c46e7d2438e7996024f9b0b2c6511ee0d8c4552f9ba734b300f9986ce4a87d8cd0089bef2a88c2e0e91c962f82ede124d9b6a296d76361a6b27382c82bb20c6105f80924a71fc0f5ba8467bf14fb4f234b8cc19d07293929cbe69896e1689da95edb489c04d2cb7aebe618fea96e5ba77850e6dadb139dc6870be31cc5f4c9e602196271d4cf91b457659fa6ae499c289ac207950fbfc82b88173bc3dfd9b9219b7150dc99c045cc6febe92bd71012464ae4c757ff029567d57b4b102acdf99b8fca171d1668e6d1cf03836cd410a22498a7bce4aae25330469f25c32b7f3ceea71a5b2bad263a14b3c1b8fd3f9666fac1f7d7445ff04b1c1447dca2f4044b401b86711adb36da99b28801b38da426811f43dd0dc26d1af11650bfd68e3527e211c6f90c76a17d41826444ce24a3d1178d820631dbd1e07e2e7137cecf0fee0ef2f78dcdb02f2225d31451333ef9dab0d9513db6a045bbbff6037e1be78a0fc80163eb725745a50c2adfbe38814fe5fc311ebe3b5e15e059f5df7cd00c5f27918e327d15cbcf4fa3b04a986f75d13f068714df6d4a185ab0ad4fa39042db556422f6047a80a8e9b32c045bdeb98d664fd9f3ebdd3fee605bc721130017b9e318fa8e9a4140776cd30a59923c568b6dc52657665f69c7072bf68f3f15495afde8fc03da9b1d91172e54a63fa8f39909e9b1e90600a66935919b8b58a", "cb10701bc8439b32fc3021eaceea6173b725a083a8cd04aa3beef8321d0896c86a7e03d306b2d1ed15a299ae8be531ea0f98e13359d5b1c7905ec5fae62b13ea9f73030532a9d5aa5b0b9cd8b26866cb6ac7174b0ae734082c6f11d6765296863af2f4685669e39a5e0a9b6b6346cf66ad89c669387199c08a605c34c92e10edcb5f4ccfde8b410f6d9768c0effbdfd83f14820c944893d65f2174302c4118242450e9039867d1b0e054514fec89b91fea0e0e4930b93b9c2a5a9c49b3d375736b51b228fe0affb694c31d01fcc7e73515b79d1697554ee3df3eefd76582110717fee88d93b1f0b7b6e818625dd5ee58388bb0398ea4ae5bcaf45807a1f82bcba956b12c5afc0fc35958d84a73fb74f751795de69bb96df1b053e4d3ec7acafb2bb4c611550f5c71c62b262eff5e12b911f5fad21db4d805f27f94f5e042d9ffd5813e93ee2c395212cc7a55cee0918397bff0784b32ae866ba0886707f3ad1bcc222f28f9be55dea354f02d0e5095fe982e2fc5457c3b93abc41699d447994e87caf85631a3896dd8b0a4a916136b2265a47fb0ec9baa48f254aae5ace0fabfc76e8c5fe7973ab533906687641cdec331b963c56e9cc38caf418b330e6429b6a0014cc56fa5138c5fd8557fd1c8d2d4367d3d95dde0690556f1baea02c2b9604ef8de6f725449481ee4e775cfc2960270884cde6234379bc28ae351678a8b449a68ebf7e19832498e8a3915f239ce8fc948946eff59e3147fcc6a084cee9aa586f96301faa2303a2155ed08985531a74d912a2c08f17fcf302f1f1883950df048d132a383f6c64aea3ce28f841ad3779bf3119f9e55bf926cca8204c8a1cd5d9407dbb9bbe665aab68d8a5652696665406da6d8f6fd6891cc9c860d35a419ff7d9b013678176951354572a17e0531a8e668fe522be26a19cc9eab8bd42afe0b9569aab25ac24606538e2c5d4e13ab6486deba97471c9f66254567dcd9faa219b62622ba2f513722974bacef7adecad73f666a853709669decbc0c1fade2b59d33834d1c211ff0d69dbeb1a9e6e19af975d10572b7052ba96a921414b6e7e7ba525a8ce44633e418f013d9d0db21aa7552a8b21cb01d345ca32ad4ede968ac3ae17b709279ff0f77d89cce66d03324b05d2410fa5749851079102d528baa5d49a5361ebdddf8a935b849927cee72ed467cf90bc1473152913f42438388afe67cce4c1f6c9cae1819ea4415f5003c981fd6f1ed767229d815fe9b6077d11c649219077efce7536f2fbcf3cb866b475d2bf4776d1eeb501c5cd0ca3a53e45705062a25fcec7e64357de647f47a6b66ae96ca85e1f5e40848b1a6dcf63450fb2f7887b507b3559dfa43ba1673752d6ff93b47e5eb67376ae4e3e6ade48136132c51a138bc9c28c1763f4e9165233319041a42b33439b8cc67e22b47a35e89e1a061680230ed09f1ba5f39d01a793095ab1874b61ffa800ac094597b47e83404d74a769f6e21c1c3aa9335f9a9a6b5bb3de3b81e104e72e20566699387d028899472a93c93824fa192a4f46086fc1521acced1f21581f215946bbf9c9bf90779b688af68f1ed597a7be01c785836bd573fafc462ba1fc57fc398e6554d61e39ae21e1839f3e818a264fa6beca3f8cd03c3b224443386ee6722a05edb0b4f1b7938a6fd271af115b29b0698b359bf6db7cfa1fa3cc49a423ef7a248694cbd1b39c4429da63f9ddc49b3ff3e3133489db76170e52e8dfeb1be2ec6df4123a81a476e76d6491c637fa1bc1a28594f638767bc13ba9f8ae87e92da43defa1c3a4e32249983ec658efcfed2bb7157a5f2723546264022997809a958e0a5a0adf474d3ae613e97714f4cb82c58e0066bc1c6fedc17b1e124a62a2861974f411857886a597166053b326d63b9a2241b3c6db1c3830943aeae4a877a4afc3709753ce4fddcff285ed65bb4d72d847f996c761bb2ef09316184a10b8ed71f0bf065429f6a92202a35f5331ed5f69b34b4bb1d94084b3f4328344a329eb2dd0b983f2fa32a4c69e84302117f979cdae9f058fac109bfb5a008e862226843da49dc37e26f53339dee19a861495b57e2e75d5f4cf9b4589a338b1cb1c6b45fb29a9fa80564024a7b77642a755120edebb9abc88ff0787263ee446807b49cfd8ce463ac33bb8d6ee639b68c094db410c18ad27487a1fcc8ef1f65e24a9744b07998678bf6eda2aecddc48d6ef1503ec13f61816db636d0ef5472affa8b9319b1305c487a1d4f3507d4f6d7d4d67a167b028b5644b708c849c249b3ff3fed445e4eac879c64f5125eb0c739cb83c42d984cc5282a6d28f1551b648585766746c8600c681a07bf2fd65a89f824665b5210c18b4961afddc4d4a3f3b836816233b5f2ebc84e4a7297af47bd6ab84ebc443a73e9195545050f81d5bfdc4f42614025c7684ea607377926e1d91f542dc9e495f53a112f439ae03f800a8396de00cf33d3734bf42e7dcd371d4267434542bafca9e3e98750828b56fbfaaea18dc74c04cc7c5fae308281f6f8b08357db950a295403e221aeb8a2e6822fe51ce474457582ad68f90c0653e66955e02be944a43efaacbaf29ad4f1293fc6a4787ad44cacc541ac03022d2e3e53f638e7e4a764bc36c55280f0991070a1dda56fce042e545aa45efb37d942608888a2a3bf1d190b63c8fbaecfb9578660ea6eca56294237e247a46f67980f154e92797a50f93cc4c8c6b87489e570aae47cd45ad6ec74d714d310c1e85574db4507a6df0cbd0c6607a6b2a36a72a33bda22a2132fe36c07ab0b3ce7a522d50217c325978cb539881f6e2fb05126280c3cfa23301d0b4bd544fb9e3b25ecbce2d2df5dc5743d7a828f2f252544a321c169a0971a6d30708ba63dd6d3ba054919db2c1bc6ab0794faa3c1fbfbcedc8debf78746b57e6fc2aec727720916e1f281c81cb5f9a2a9f263eb589238944180072f1b110c973f3fcde8e53d0132cf8ca89f726df98a79a2f84781ca9b1a99536d129a76a421a470330261989e39c777740c1a9e4a3b1f00370181ecc91af4684456e6ad5c180a24a281dc885a88fa96354aee49502a94fa819973b56aa638876387ee8d051d6aaa6d211140d5b3cefd55a1cc51aad4ed6777527b27d7cab09f372508f6d6cc510b5b129f4317987cc163f313ee35e75d8ba8dcd325aa00a677f0669d489bfed38d99948788376f80fc8296252e899b6f2c0d508e6d4e18eac160e69b05df37b7e36d6e476d7f97dc52698ec458d5d6a16ae474bf932be8c9872ec9b77b6e27eb3d6c52f278033337f36fb516db648f62f5c7e8e846b5a3f711728c5bb393fa61ddd5d7274cc0b65178ad49966e664f422be9a1c26c9d93be1678a34e23fbc0d68e6f7497200b2d9c804c1da5e252492bddd436f4934746ecadf9a3e12782ce708482e47a8af8df6eeac19a47028690bc491f5f4ccf233f8a13d5fbff56b4246731bfc34576c787c476db69c0c671ac7226e1328392416ed43faf23572c2faef331b21ba1765fb11d1127cfc7acb5f3d55c6f240e3e12d0e003224e51de446f39857df071329d321fbbc682e007a9953ba846605cfc122ce02be10f6a8ff576003640d0715055939dc616688d6a028c442dfb1420eac7e24b082c9c20e788c932b915efb1a7384ecdcbaee1ff5ef82351735cca82a2c9296b442069d846f86fcb383ac377137ca260e9f441ea2127c164f45cf50c5c8173d812e24de0a0db96cfddc22788a62692dcd7f1a4bf04cf0355c132316092eee7ab7887c3546b60b21bdaa4fba90daa29396e761669daca2cb0e46feb86a31f3a6f6609ecab53a9c5d07a21f49c4e01e2cc22b35869e8e12dd76f79319dd08150eb219975d074f8161ca53952db11cc08e6483bb9c191573eaf3a4344087a81541951780e7d23b4b01887ee4bac68c70d77155e1087b1f8d959bb2ef1a5dbd8c5c98343b50fe525144f98d967b132bfd11a35cdad510554e2ed8798bc08492b0632d4eb1f5f642663979f308a67487344b3aefb308a66ced654db85e9155ba7eec6be223c3a8b4ddba0fb17d452ca124a25edea559861e2578bc898c920b53c5763c1d08f47c958efb4d26294628bf46dc64191a696c6878d01a44281cab48ee02a0ba1a9101d2cba30b22424a973c626db1b3d9eaeb8fac3a7d3c38d426ea1a14aabfac1c9fdc53c0a96cb9738575970b30cbf904b11a2fbe1ca2bf46129d1cff944c5f17c65a9b7bc36d41061a8fe2dd1273f4f5822be23f3e0ec2de61258a8b6dffc2cd1445fd7c3322ebdcef159f03edafbcf1103b4710937e72b1acfa841215d114d773be6601b098e74786d63ad4ca4ed147b7181a73b30db5cf9f2918400b95924c970b45824afa34a3267fa38275a94a2bc15680bc006b34ec87a296357e5ed5d1edec5f86bd2cc072ba29dc79a8d310243d4207983e76b64c064e6f27606fd44e59de7f29ddca90a197648ca1d7a2a5de95a55ad0daff6838f3a6e3f65f2edc29e2f8fba362793f428f2f35cabc8ed90f818308e2d8d8cb6d7729d217b0b8515e59728c5fbe2a73a90bf11028b3efdd4e2f1cf3a20578bd7e3c9db3193955aa04116b862c9a3e1b4aa97bcbe97eae985064b690f78ee7844a35080a9a658fa93bac8d4ca0e98dc952b903b92172cf655f7ab7110bc231db560ee3bc95638b79712cac994fb3b3c73791cb26473d4a57b265859bddf844b1c44f9be4ecee61abd897397ae4c6483a67ec60b77dc4c632ab610bf639267e3bbc4b3bc13999f6911c670c58093ae426fa78f87a088a5f6650f17a81fa39ac461d30478575aee3240e778e860125d5f2c978035f13843a45e5a4a80c57a2688a153348c7baef89989c21fbded3c3e2a5dcbf28f21ee513368395d05e495bc10a95fc0d1ca0addf5282c45f3e1893551df70e9ccc31f55511d87c7feb49e94abc7ffdd0684d45bbe459e4bd1740c82fbfe53e827a173354be166c8a3ba171c35ac693977d6ba399409a2230599b19d0311b869876bb4e3e7a94ca59c8cadc2162f03dd31864e01feb053cce77ba787ca560cba5efec615c902a8b5b6ab5f172fadad5aecabb949c621d0d00005f4b394bcc543278f760e2572e047a79b9f389279b8d77eb257c869446f15e872a5b125a2ad1ea3eafe856e8a158ae1ceb87ac95d3f5fd0a8fd99e36da0e587c329220f3cdf46a1c4fc37f2bdc2791023a0edba491f390446ba91687dcf1e92a5652d70bb195d7ca3d643ab459f2a2b8de3ef7ce2d7f555d707dbbe5236ff5561b751c34c4bed987c574be048fc4ccf77d8e4aa223457ec32da1caa46bb6fba8c81379ec54e48a723ff0eb9a79ff3e8ef2403167b28c2278d9450f7ea00f672d9e1ab105eaf6c86239fa7da9c11d2b123273e43ea94559af26739f9dd40756b986f450cb6de14efccb53be6e1a2130717c3335fbe1fd7fbe29410b60a296128805f40dbda355a09849692cecc6d49df88e46cf8480d55ecdde870a1e03bb511a6347bcdbe09f46985ef4e2e60ffe026a4a5b3668680e8d80a23a62c7144df2fdcf9e4fe3279e1c4447da31519b5faa35747744e54368d9570ab06f58c316a275c982494291f2ab0d0832dbc2e8e8e72351d48d9357ec56106334f5571b664aacf2c365f24726f95de7cfe40cd69ef1ef90c8bc3a640c434e36a899cd7b1e4bce1d5280141a27a5924868e6b04813c3534b309e8e209cab4462c88988bc75dd1251d5e50e27da7e405eed7c9213706db18960254602f8136910194cff6d205b43a68791dc4d45128ba57c8477"})
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:54 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
pipe2$9p(&(0x7f00000000c0)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RFSYNC(r1, &(0x7f0000000100)={0x7, 0x33, 0x1}, 0x7)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="020800000a00000000000000000000000800120000000000000000000000a3f6ffff0040000000000000000001000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
socket$inet_udp(0x2, 0x2, 0x0)
openat$apparmor_thread_current(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/thread-self/attr/current\x00', 0x2, 0x0)
r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x240000, 0x0)
ioctl$DRM_IOCTL_MARK_BUFS(r3, 0x40206417, &(0x7f0000000080)={0x1000, 0x3, 0x8001, 0x8e9, 0x19, 0x4})
ioctl$UI_ABS_SETUP(r3, 0x401c5504, &(0x7f00000001c0)={0x5, {0x33, 0x101, 0x10001, 0xffffffffffffffff, 0x1, 0xe21}})

14:03:54 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1200000000000000]}, 0x2c)

14:03:54 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x49]})

14:03:54 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x3f, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb"})

14:03:54 executing program 5:
perf_event_open(&(0x7f0000000180)={0x5, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:54 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1300000000000000]}, 0x2c)

[ 1745.941802] binder: release 12973:12980 transaction 427 out, still active
[ 1745.948984] binder: undelivered TRANSACTION_COMPLETE
[ 1745.961371] binder_send_failed_reply: 12 callbacks suppressed
[ 1745.961378] binder: send failed reply for transaction 427, target dead
[ 1745.974220] binder: send failed reply for transaction 429 to 12992:12995
14:03:55 executing program 3:
socket$inet_udplite(0x2, 0x2, 0x88)
r0 = socket$key(0xf, 0x3, 0x2)
fcntl$setsig(r0, 0xa, 0x33)
sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=ANY=[@ANYBLOB="021600000a0000000000000000000000080012000000000000000000000000ff000000400000000000000000000000000bae00000000000000000000000000aafe8000000000000000000000000000003710e92d69044d477ab7796bb5dbc881e732c1a653d241fbbc681179f94df9c83d77c233945dfa6f98dcb71ab9e60b0134c76131c70d2a9d15fc"], 0x50}}, 0x0)
ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000))

14:03:55 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0xfffffdfd, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:55 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x79]})

14:03:55 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1400000000000000]}, 0x2c)

[ 1745.990675] binder: 12992:12995 transaction failed 29189/-22, size 0-0 line 2896
14:03:55 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1500000000000000]}, 0x2c)

14:03:55 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f0000000100)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x3, 0x0)
bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r0, &(0x7f0000000040)="f72d39125f78eb0b184b191b1d019e"}, 0x10)
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer2\x00', 0x109000, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:55 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1800000000000000]}, 0x2c)

14:03:55 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
pipe(&(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffff9c, 0x84, 0x73, &(0x7f0000000080)={<r3=>0x0, 0x3550, 0x30, 0x3, 0x5}, &(0x7f00000000c0)=0x18)
setsockopt$inet_sctp_SCTP_RESET_ASSOC(r2, 0x84, 0x78, &(0x7f0000000100)=r3, 0x4)

14:03:55 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8b]})

14:03:55 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x3f, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb"})

14:03:55 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00000000000000]}, 0x2c)

14:03:55 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9e]})

14:03:55 executing program 3:
r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x400, 0x0)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast2, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0}}, {{@in=@empty}, 0x0, @in=@dev}}, &(0x7f0000000080)=0xe8)
getgroups(0x9, &(0x7f00000000c0)=[<r2=>0xee00, 0x0, 0xee01, 0xee01, 0xffffffffffffffff, 0x0, 0xee01, 0xee01, 0x0])
ioctl$TCSETS(r0, 0x5402, &(0x7f0000000100)={0x2, 0x200, 0x600, 0xf199, 0x7, 0x1, 0x9, 0xe7, 0x3, 0x1, 0x6fd6})
fchown(r0, r1, r2)
r3 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r3, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r4 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a000000000000000000000008001200000000000000000000000000060000400000000000000071603daa0000000000fe800000000000000000cdb7ee1700aafe8000000000000000000000"], 0x50}}, 0x0)

[ 1746.807011] binder: release 13026:13027 transaction 432 out, still active
[ 1746.814134] binder: undelivered TRANSACTION_COMPLETE
[ 1746.832898] binder: send failed reply for transaction 432, target dead
[ 1746.850539] Unknown ioctl 21506
[ 1746.872559] binder: send failed reply for transaction 434 to 13036:13040
[ 1746.874638] Unknown ioctl 21506
[ 1746.884219] binder: 13036:13040 transaction failed 29189/-22, size 0-0 line 2896
[ 1746.904742] binder: undelivered TRANSACTION_ERROR: 29189
14:03:55 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x100000000000000, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:55 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe4ffffff00000000]}, 0x2c)

14:03:56 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc0]})

14:03:56 executing program 5:
r0 = syz_open_dev$vbi(&(0x7f0000000040)='/dev/vbi#\x00', 0x0, 0x2)
ioctl$BLKRESETZONE(r0, 0x40101283, &(0x7f0000000080)={0x8, 0x141})
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f0000000000)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:56 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
ioctl$FS_IOC_SETVERSION(r1, 0x40087602, &(0x7f0000000000)=0x6)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:56 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}, 0x2c)

14:03:56 executing program 5:
r0 = accept4(0xffffffffffffffff, &(0x7f0000000000)=@un=@abs, &(0x7f0000000080)=0x80, 0x80000)
setsockopt$inet_group_source_req(r0, 0x0, 0x2f, &(0x7f0000000200)={0x6, {{0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x26}}}, {{0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1c}}}}, 0x108)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:56 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = dup(r0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r2 = socket$key(0xf, 0x3, 0x2)
inotify_add_watch(r2, &(0x7f0000000000)='./file0\x00', 0x12000000)
accept4(r0, &(0x7f00000001c0)=@nfc_llcp, &(0x7f00000002c0)=0x80, 0x0)
r3 = syz_open_dev$video4linux(&(0x7f0000000480)='/dev/v4l-subdev#\x00', 0x3, 0x400000)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000100000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
r4 = dup2(r3, r2)
ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r4, 0xc0505510, &(0x7f00000000c0)={0x3, 0x1, 0x7, 0x7, &(0x7f0000000080)=[{}]})
getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@local, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in6=@mcast1}, 0x0, @in=@broadcast}}, &(0x7f0000000400)=0xe8)
ioctl$VIDIOC_TRY_ENCODER_CMD(r4, 0xc028564e, &(0x7f00000004c0)={0x1, 0x1, [0x5f1, 0x702, 0x0, 0x3, 0x3ff, 0x8, 0x7fff, 0x8]})
ioctl$sock_inet6_SIOCSIFADDR(r4, 0x8916, &(0x7f0000000440)={@remote, 0x79, r5})

14:03:56 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x3f, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb"})

14:03:56 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc1]})

14:03:56 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}, 0x2c)

14:03:56 executing program 5:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100)='TIPCv2\x00')
sendmsg$TIPC_NL_NET_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x14, r1, 0xf2b}, 0x14}}, 0x880)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x40040, 0x0)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000080)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000140)=0x14, 0x0)
ioctl$sock_inet6_SIOCDELRT(r2, 0x890c, &(0x7f0000000280)={@mcast2, @rand_addr="05db80d8ddce1edcc43a18d8d2f12ab4", @mcast2, 0x9, 0x3, 0x3f, 0x100, 0xfffffffffffffffc, 0x1000000, r3})
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

[ 1747.672859] binder: release 13069:13070 transaction 437 out, still active
[ 1747.682545] binder: undelivered TRANSACTION_COMPLETE
[ 1747.690153] binder: send failed reply for transaction 437, target dead
[ 1747.722843] binder: send failed reply for transaction 439 to 13081:13082
[ 1747.738566] binder: 13081:13082 transaction failed 29189/-22, size 0-0 line 2896
[ 1747.774154] binder: undelivered TRANSACTION_ERROR: 29189
14:03:56 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x3f00000000000000, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:56 executing program 3:
socket$inet_udplite(0x2, 0x2, 0x88)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:56 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}, 0x2c)

14:03:56 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc2]})

14:03:56 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f0000000000), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:56 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x2c)

14:03:57 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}, 0x2c)

14:03:57 executing program 3:
socket$inet_udplite(0x2, 0x2, 0x88)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000001580)={0xa, 0x2, &(0x7f0000000100)=@raw=[@call={0x85, 0x0, 0x0, 0x21}, @jmp={0x5, 0x5, 0xf, 0xf, 0x4, 0x18, 0x4}], &(0x7f00000001c0)='GPL\x00', 0x1000, 0x1000, &(0x7f0000000580)=""/4096, 0x41100, 0x0, [], 0x0, 0x6}, 0x48)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
r2 = msgget(0x1, 0x8)
msgsnd(r2, &(0x7f0000000080)={0x3, "801793642e086476d4202f673577c744c7ec35ca86abbe7d80611215122bc4de799ecb1098fbd1ad20d071eb4d3cac7c5061889fb5ae3083877988a25f565232776586cd8aac7c53d5e9f79b7cc49537d8ed6603a0eac57d159763ae0546"}, 0x66, 0x800)
r3 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x2, 0x2)
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000400)={{{@in6=@empty, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in6=@initdev}}}, &(0x7f0000000500)=0xe8)
sendfile(r0, r0, &(0x7f0000000200), 0xce48)
sendto$packet(r3, &(0x7f00000002c0)="1b80bf1f62cfd02a18d02df5240eea1d4f3039b13ebb72cef9ef6bae25f7f451fe292a6df67a6b789e44e76b274011bad0c391b6ca8e32c4e92cbb9a8795b2f29ac12075ccb7654223596eb9c5d4619566f970520dbec160007c087e85b3f17cd502a0a7b67ce027228af3fb805faecc0f98c517bfcd00f38303334a425f2c9493d3b29db15ebdc7e9194af8ac2794da0439d6d40a02261756f8923388d228fcc142aedfd7833ad995b471a98c5beb992683801239b8df166b761b03c44dbce444329269776aa5f24defbd2ee7a29efa134c58ed14834541c367d1e92478d54bf67f68bbdceca85596ed3a31316f4a883bc96bbe", 0xf4, 0x4, &(0x7f0000000540)={0x11, 0x1c, r4, 0x1, 0x7, 0x6, @local}, 0x14)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001600)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000052000000000000000000000000fe8000000000040000000000000000aafe80000000000000000000000000000002618afc915c592dcb86c47ab9da3d161b1108ece089676293b8eb3b5790aa2ecc8f9d8b489134aca36ab3bdcf63c0963e22e7e87c88a7deaf6c5388eb43211f1cdab42667fcf5f647b94acdd08cc3715ca29f87e91cae9f3cfaf815c0897e522b067a23be511a0d26f3e7d778e081a6cb5a5f8874"], 0x50}}, 0x0)

14:03:57 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x40, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04"})

14:03:57 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x2c)

14:03:57 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xce]})

14:03:57 executing program 3:
r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x0, 0x0)
ioctl$KVM_SET_NESTED_STATE(r0, 0x4080aebf, &(0x7f0000000580)={0x3, 0x0, 0x2080, {0x7004, 0xf000, 0x2}, [], "92628831c05efd84bb7f161d1d5dc531ec94d90670106b185bbe2d8c555f2916426a534f94130c3ec516472129d18d16766ae655c74346f240c28a3f2d84e10c9c3bb0930b3640da015aa2d057bddb60e32926595f33ef69d7cbfda5db32e330bd6571e969f00a014d888e989625257407508b126fbd68e3b611e1d7dbb57afca3319d1a950228c7f744f4068c051b3101ff9918d79ffd29f04dfd1d3df54c64a0bee279b7f2bfe6d6efd5390be644a1cd2091e5bac957da570ddc946192b1c4a35b2f9443fc0c5ee2c574449835c7611477ef1636eb476b466ac19e37f3a7138115f755840a104f80665579e7aa58f8bb64708ba5e6606d02dd032f7f222b766b3bc14a558cb0aa4a5e2529a2ab2c54d8b8835d622b918141712b2bfddc1a5112d00db07982b6044027bf2e7fdbd5aafbf0987b27dd835d307a3f2ba650994b805520d9d0125c3eb1e750745bfe61dcac89c8b9b74c56342c08168c91e421e7eefa3cd5816a543b5ddc258c7620a01e6898a96ec0fa33ca95141f6c2db63e84ff1cee6693d05fa7253b70a49e99f56a602a1ed92329ade6d1b2441e9ad661faa57ff39321c6380b65a0ad19719d5c411be5a369635af31c684869438af26a54aa8dfb33d4d6b3e5367e466326e68f7e8d17f03fea3b8fe1d383d5ad1ddf026436d10260b9e0fa980ea58571dccccb0915f0d8550a705ac9d988a99263a61e9adea84b099ff2e8c28676163bb4033c0e4348c2267a548ff06308da93ce52c26bed586b513b018cc013471226a87525168a3efa93619f834f303cf81cf0ce599e78ec6b16b08d47b9bee0ceb3e19af3a0f49dc83c324b10dd332ec8ade9068df33e34ba8917b5d011b3432633ea56160e7cc800ace5ed83b0f98b687aeca036e389bce73e82cd39f9e0dc35483ebbcdb5efe671b5aadac2a06aaf7a9d297fa591a511bd2a106303af4073839cdc76364524ccd853c6112f10d76345884c55ce1aa78dce0c596d5b40a4f7e00068af6671a436a06af03db969f717552218a0e232af2a32854213038625c88a62b338100464cfe9da00b609ebe60bc2c36728306bc7f76a8f47c95631b9aec1b578a747ecbb708d06d2f7cd40d0630a78cd66c8df6a73dd052287b372b5d84c72c896b3d7e2dd6ea13c836cd32bd5e54a195088a72c81937e9e72ef03b686b5dfc749c71403e97711fc11fa4997c20f4ed50c105fdcb6e71ec9e3f65b3b59586a58155a65acc2921db4a9361283df6e231005a828de8a78792f9bf1c3d8b8bae856c14a32d322380f1b052b69741f08dc98d7064d0b10bf42c707187487ba23d59c8a5b511b6dcb7576669830b756001480fd5e253f60a15abd1b4c8decfcefbca8ec7437b250fc8f078d38f154c3640db7a734668e929d343b50e4dfa468bcf4bb0d0b435dce0456aff0f9d4396ae725381433b68357630ba038c26f8b93253461c36a4c506a61cdea3be6bf7922f14ca7e2fcf279b6a462dc86dd03be17c6315e5ce555f75ab3c841b26886f68b866952cbfae9a8e53e2882371c7b79b047c216e4599e9704d79eeef93cc88b5f181985e6e3a6bd4ef21703e5d381c0aefdc452121b54a89edc627258d35a6316ed27bd1b8148be1713ce1f416a4a5995051799351b3266d91eda19b3eb2200d1d5abb7af60c31e3f38e89d63bfea4a43d3e9778c77faebd34cf28dd8e44ca34f680cdc297e9a86d5f6e22a47784c73de8aeb6a960bdaed400d874740cc45195577dc5cdfd0fdf39a8e7e5d408718ce8a0ca2c8845d244cff47470efef04e8e1f06e573619fb0551bf815bab2a03948bc06c39b6f5a57835cab2a1ccf4899d2d01b718a2fde11da1f77ba3b467c8bb65a235afb0e54a0281a21949f96f0d41a1439ded2418f948029e0f5db44398e4f80ed39a162cf5eb992bf3edf8c2302863b74aeeb4750219602941f68452af5764d1490c1cdd29f164a54c50ed025a3e4ca26ca2b1af186c885a4ffea26cb8832b088b6bd70f263262cb950528c14951f3fdf1f6722dc47b4fa57bd4c08b6a1a8b6b09cf47ec463ac965135f998ac56ac5a92a9f688eb53b0d3f215d5843320a5fcbac122378e2a5c19f3ab8c615afb2ce1029af012bfea6566b93d233904a4fed33ecd9da712a41f2baaaa8488aafc38d767a579ced269340c410f4f26737709b2f4a26fcfb3ba1e20906f7b52e3579048d187c1fa9499b824b66945685d3595c28dc45efe679161d6af7f487337d04f1b67da023074e233c64e5de58375953dd608f5ecdd85ec62857f8fe6d51872f936a5264ed41952b61c9d6077a1fcae96ac70d5725594a18bf7d07f5a4e04a4186899bc73bdbf4c56baad314cebd4e3baabfc85271070e9e07b4ee5b153acc114b819da81b85a9b4964543b886e078d466602f603c1c0744c8b9946b688d04201c0cf3683d82481b19fad551acd196d04a91ee5bb12dd94f28c36646ea8de9736922377dca3804c4270e812ecf6acb49131f99bd00b4526c38340d3f00e5b0475d47ff57dfd6a31e45714470d4373f4400cc0de32f1c9be3c81fecfe7347217c772bfd1cbed6939901503bbb7f49f56361a333c1eccd581d9c6acfea911ae768a0c9ee9a42ffc5b2bf0540cc0d08c065b5bbd305e6054c1e27b0e5c5cd6d204b443bb7c568b8eda085b9a3942860f612ffff94195a82c9cae6247b92fbf3acf7fb11efb0550666fc003b20cc5d6d9bbfe3cc395cac85de866784f4cc73cc0eef8f48acfc6b6a5f013c1712a2aeae1fc4102f2bb3d5017142d09a333c8ab718ec9ba15ed3e54e25777e1ab018be17e47901651900455773bcc0665bb263f70fe382a744affad98a51a968b208a39311047bf48e1e8cf07a679fbc03a9f018bcbf3715060bdad53f9201b408ddba7b004ba26707373426016c7358c0edfba991f4ed2b5b7671d457a912e97d3541b5518138233e1095a18c55383c08f1c11f0cb3838b5244fddb73ae89303cf37aeb6ad49c9da3c91b6d31b87d69bd8956accc5ddc30137ff31c989ce248a5d83cf4ddcb6a9e52b4b0946adfb98cb168c25de9fa90086ba3b2942e4c064cb8c228cf4d0910c767dfa6de2c8456f82fb80fca728d66616c6c63fab91afb4d535cf3dd2fdc501e976ac4ba30775925058ff435dda32e628409056a2cd31ca691ad5c45a073a3a908742d3f56e4e47600650908597b02ad2c54dc3a1cef67937b1a7fa232ba934af9b5a70967921687c3d7337fb45c86199c999436a510ace3749a9a68ed132f56854217e21a084b961f716aceab1c5895df34b98c412b6758ba6dbf8279dc96db770ca44b23807c893057c32b38caa36fa108589a65a363b96ad85c8c581fd31d4852f94037abe2866f3de93b32c81c8be583afbe7b7729b1da81c085f0cd19da23329c8ef060bccf47292f5e6154f757ab019b543d6c2fe54820a2b7b15b9dd3da48710ab1caa6d63759ed1037fdd30f61bacf6c80eb99a7c42cb0c020384949675261b018e0cbd11310ba2418640817d40023b26ab630fcc92df0ea48dda2c27bde9bcf3502f788499d90f93d9b9583695d7a942b571005325dd2a4c83d374c09d8eabac084645c5ffee67e81b1f33037651ff61a93a9292a62855343c47bb1cd719b057975bae02fff41b34588b47e3a7a804d5998130bbedd894f37ac8171a6149c3d390181b31b1e54cf75fc83db7b71d62eaccce92e81e3fad43fa4bf318e3df8d2f2055f67635ae1194b9f34d929132838d2495ffb5429b8e986d52f13c329b9b12afedffaafd63b528addf875509516f428135a2a0488de70ef9988257840a317b975a838e7094fbf6b44d6e028c823e4b93b0ae3c9a23547e4d48b76d87d27f124fe4547312ad97d2e0c685cc95a6f0a5cfb3961b9401597ff72f26acc94a49e822442e2659b7bdad4e8e61e763e62ca1b3b5fb05a726cee025e630d63002b9728825f4fbd322845223eaea3a86dd393c5bbd1c7b953cc064ae1d09aab0c2f507d63c8aeb92e9863066236ffcac2ebc7e8962c4c8d7c44f236f921cce267a9e7223e0e1360b7d5e2ca4a59bdc6725eb92c90a50cdd8ab0977a09478d81127b4dc0b344bd05c563af30b5ce5bdb1264adf3aef8c401fdc3de2c7af5ba2b410542312def7f7cbee85405df7afe588ca5fadc82478a585f68b53f11a96f7204e03a74949c8a81c7b4073b8309293dd0db18cb1d3f13014395a7df3e622f3322086b90abc17a11a2ed681ff150710a782ba3784eb01fd8f1b0ca4a47d69b8f55e96f6b09ca709ad8ae76ece6caad6c67e8e1faa2198b1308433d2672ccb056e7491484b211870a378294dbd56dc4b8227cbc82b23a236c7e02588d7b7805f61a2dec84819cf4e86387d47a52f9a4aadece9a16ae6091dcaa08e130b934b2ce568210cae01e65ea2e75728dcc8c8b2a6cfbd53e32434071336cae1001865386b12d1f4d80fd04fbc40942597d498ee2a11885e169ec7f1f8b28a773ac778bcd6627ee23ae8f18c353a10956e0e92034bb8e5eda44299e4cf60e200097411102f4c9ef0c6e456298bd1edeb1b2ed24e158338cf76dc32e7e7cabe3bbfac4875726a3cd2e2a84926df25ce14704178b326b5adaa4f0971593da9c744d3f15239ab429569248495fe604543ba832bd3720965a1182b533cf0969498e10650c32ee1f8fa257a2eaf09462b7be820d62e5788adbf25f8f95db394f8f7769675c3641d01391aac8097b4e45eb3054f5c8416065147ad7bdf34634fdfb77477cbdc6494f6d40be6990d62d5874edca26c7aae13120ad5c2a9068e8471c77d0f0d9ef9b460424679d720072a9889edccea52ec15a54f2db1f58a668c7ca44242a07f49b120185f9aa18959db7ee3f19aaac325ea92e10744ffb1c950845e80288addb87de92a09ce8678a5622d8c86a5a45179361ade68fa17b12ed594498d7f9406e376c95f4404c1ad8f3d21bdca97a469fa9cbd4a76c16fe869021d0795c3cce42cc37bd8bf8846003d47c2ea243c83d7da040af05d8e9d291bf5ec9835d51a22f3c10d0dea61f4fb596cd708511299e4a03c9384abf86b5fc343a0a86fce42c960770e66cae1109b78e26a79f68c9d856ae7d738bd06ae7d27d0f0035783b8157a749d47f84a23e8e1ee374e85e122a2a2e222167f2c7e4a3de7095ab6086d72e923a55a55f6da19aa07aebf85d3ec59202080286e6a1b0ee7e84f2060a54c4ab48ef36d97468043109e09c34a71dcea2c359ac18346a4be53fa6992ee84e5d7a98e0c9f8f092b5d53b1a8ad3b48f03c84883b3d0e2d028e8bdb2c0f8d9e0bdcbc8c070eb777cb676d6e69bae062188231f5fe2775e3ccb3a542c898f8911061405d1a9f845fb2fb1ea313b276a456cf30e5a9687d01212bd09d29c3f3994e940627a2fbb742e4c6b5ede2d7b463a7683776f9dc83c794dbe2232a12c7fd5a0e570b7865665341923ee811b419b146f6f01525b8b6d35369d821a9af4de8dfd731ad7c415d429badde6c14ab8683572b1fdf15b5724b86147f76861854d6a551839adc4791addc88916963f17b8c36c5fa97e2ca534f538daea3fe2555fa96507722599bd4ee01cff2469b5570bd29625005d6a1e8777be492f0557e3b164d407f2309a5a71c530694db4946345bff94eabb98e1613810b9e1c47925bc48e7e9f1e4cb82b6e64e0ab8236419db77f1f7f261db35c0ac0231f3ea13abfc81e16133510d5ec2176c258f2425b933a254354cd33e22e483107c4ca20293da00810f4d190fb2370479c78dfe2ab06897eac7ca21050bf5ce", "4a367057486a8bde01d53ee14574241904e0f4aa6c6655aa1455ef26d53caa955bf0a678e59673ba6beee440fcd490b19b0cceebd1bfbadb3b9ddad0fa6bb6a2cb054980a0a54aec2cec00176647e080567fd82aeeba468d171e8840fc0d9fcb3112d3bfbe56973c08feadab63ebcc70181df5b1f27f01384f5b17a1836c289fe349f3d929d2a3d6ed4cceec0c605cd2c93edb605db8f023a13989d2266791ed9d35ff4fa2cde9b78f15edd73c52bac19083fef9a8a2080a710d39ecd1f436f30844c4be28c1a586e5cf737c41ef13cffdae5e1dd96c0e97ce1290a566d5c020f9b7143e197afdc35872cd2b0fe1642df44f3ddccb3d059889571ee0399205a2ba0db74e7473a753d230bc82c0366282050417d26fcb9c80dd284b21adf91a66e19dd886bbcda7b2c5b4da4fd9d05a4ea80e664aceb4c65864d46ce66227a42edb5eff673966c6e17e36551db5c121a384a2baad2708ddc1e60870c8ab422903aa6946d585fc1252067c85dc818f4b88dde62b8406b546ad62c1b480feccc4ee19c86bdd90cab0aeb491b8593d304b95b48ed0763054f182eca3bf1a7320dfd359e293b206ae3c8a00e9ca37aeaff8fa518eb18c8667c7809a5a693d2bca005dbfb5d9f88ff9192a630de228eda1e77c8e5db582e88a12ab5d87b7eaf7258203257ce9746b1aeb31a173baadf96c699b6940eb6f3eae64b95b39d4063bc9c329a61a0c85c4b42fea630b0d042e444a2907d4e92f406c65092f08f06984f2294c96b10098b4d1ffed8d3cea628ed3893f8c9bd17bdaf0197af1e7985e5f561dfd503ce967ccde02e068160b70602ab5a3588bc796520131e7e6892c2311c85d6cdaf4f90218b2e6df9725eab53ccf5b2ee49f14b23cdba726a7f5a35a182c24a778835e101b7a6fb29b4702b0558f7e5ffae7b33c9d4ba5ec4c8f61b3c5f3d2169afd0e711c7b411d6fecba266153a03652310d816d4c3b53a98829c7444e7a2a0c244e6fe21da3d07e4705cc28f73a197ab467cc77903169857bae65951541cac68236de548b6100f82b74c44b54f84b4101dc462c5b3d8d6b2a46e1148b5a07d1698f8d3c2766f4ce49101059f58a53aca413b428ccbea1f79df7dff96437526ecc9312f0e6f24bd8a284325897c127fbf4ced904c268cd001ee251384ef382f6a0daeaf5d8b471ecbf12a73fc383114c8d19b4a4d2768b3787f6440366cd6fb110da3b0af9550318a30ced59734b6270f1c769ceb433c408e34697af57363dccbc25cf80e38d6cda82447d2b737bccb6dece2dc5e1d2d386082d65d8fabd59bef94feda3642c2423a1ac1674e69756b954aa3679fa3c2726dfb466698b564ba09906927e7f9e41d02e64ab5690d6571038a9552428ca069132c80499ece553e1e692f896283fe6fa3ed4eb95e0aaf55997f86733450e4ea3b746e7e42b27512ed5b3e3f569e63e763661f5900d86ab9682f515f504a8014e38873bda5a534a08869ca3ad41f622aedac6e580e0e1c6b0234e7b9c029150d3908d7c57da9be7a3e5683af3f0f30941bbcbdbbda2ea5dc3e21018995a9110aac1c54d7103ec2a2b5813dd69d3bcda96458b25884d8fd4449a3f1aa77003840c080c91df83c0e113718a7b3bcda1c000f246d56b3896c2d89d3800c0995d7f5372e1a4d34870cc099f459a0bc7c23bea91788e8f8e9d16e48690a1efd44b13ad50c5bedfd253724bb257c3e960d9d44d1095f135c4ba3aeab44c436d25a6463773887dd87b384edb6f48c4cf94db664d93e31e94174ce03b952230433c158b755bf299df67f745f2680814e274637d3b5ddea73a85617a823b56212f30bc8fc7a0fda6430b3793d0e4f2d73299d426495404b0331573cefe70521434deaa7c9d5c3f5bfbc2aba748e702a206fe02897b4754d8d04f26dce8802b9595317d5e34879ce06718a9bbc752704d40ff4f605abbd21f43fb5699ce3f0d3ba92774b4788e248489c0a0fea1d7ac30009abcdb26913a6529a1aabbd6e24b8f3da49ba2dfe2437e235fbb8d62b3882ed8740b4a3e651a2068565abd5a2253ea6d8253fac2e1d67cf45cfe4e27bec29b9b44d863b7ba3e1f312a34c364121c26771c25e1b793a844496b0286f71084cc27fb9180c97cf0b4f15348ee2daa9d0ea6a268616e7af8bc1852710bda8a83c5946f60382c2271678077beb09a9d9f820f1f9c895defc3473291d0021388ced4a0ce718dbe2c4b5436196348cb79391600fc9f665911599e9d196855b49168e93d73c5a5bb7147d53ca6b7043f404e36e8154da641c22e3903f8a055b29c6320fe7c70f395967c2ceeedc43f3ebc676551e8009d98e1f7ad7997455f206be2ba7d9f4a228e3e73a5656a865122f052493292ea8f6bb30d9240c4884ea03f1c3f7f31addc5dabbe01210ebc7e6f73cb21896a84b60c04b38b23558085156effbcbe2a5ce93f4e065fc9833142e966d96a0b9ec8e46cc44b1da2f10c4835ee8d57f419dd25d4fd69137ddf2eda2430104466847ae4f3aa20c4fc611f518e7344a8d668dd52f3e708884ab56855916a2c729ae0820e89f1e05039d3e90963f26088e3e8f4e99af2e1f90cecccbbb65fcc3cf94614a80046a924d06f683eb8143e09aadb63ecfa3c30edb6e9f9a4ebd7c2ab2552fe3a00ad0b273c33ebaa6d475531ab4b9288031f6969be6572239108bd9351bb0b3793923dc0382680942430949afe260e4af29d912ac2ed6544cf73801699281ce77fce996e671012ce3825935948351c66d7c08cdee267a171ceccd4b271fc90e264f98c251acbca83d1e0c00b21d8cbdf71de23f6877aef4fc522a9a8e432ded47763d3901f6a82d2199697da05c77aef75a72974bf4dace22b807dcbfb8fbbbd07187c8c72396d918ead5fe9b872cfb94a0ecb891a561e7a74e15db22b2962a034c963fde4480490145405c7b672443ac8c710127b6e974d1b7f18d8a508caab7d42372a650e73c4cb3a2cf3388bc7de25f1fb9a78185e95e85523e4ab133dd167f3f8483f27f5d32e6e9d561a858b2b5d72148c9efbe386480cc9645048d5f078c7679cfa8f6786ac5fdd5e61c348c963dfe773d99b6e4c0e5e4795979d8c675c4b3c2e432b421ad6375cbd895ecdd759c7a3d5141e15510f875b7b6e95db5d2806f98fd683bc530d32edd32ee1f02579e1267a12de0a0840384512f4227664c0698b9c8ecdda0fbba7dd27482e556d13eb0938faa5bba4c26ce0ca6cef57e5a2823a6a38489b4d2147c0fcfca96c1868c51a9d9b2fb8dd0459cfe8543d28dcbdfe9aefde9bdc34e8739e1bdc8713a2ee3a292d81168aedf7edbe11667f56b1fe13e5b30387b7cd3ca9d70cf1822d9ea9e656b50a93e997f4db7e9278b370bb8846b5f7fc9769ec082dfef94d896530b8707b43fea87d873e5ae137379d93141c3ec34e6088044778a895ad4d44326fe259c17389c64a1ee6789cd7a5766c49100d04b7e341d927604c67f271fa8a87a48c39f2183dcf2ef198e381108899ce8565eee00900c9829964b806c7011ddf7d9270b7f549a64d5bcbc53e8f391984b8b6a15ea093732f39d4d24438026c680152934e89f411a9823bbe77506416d53bac5a70480d74f4c956c5280088562fa52e611dd1d9ba6a19f6fa31f98c8cd012f4eb346965b389bdc465f0c01f1c9abae0f52169ceeba156921c824eba5c8b06c2ca489703e9a4848ec7c3d8e06ecc592887a401b06ae24eb974d39cad4035b62673c9ee7824774553c53704486cbbca53cfd04e1a12decd66df2922b0299afa1b6d608c023891db432298a97cd75bdc2d503fbcf8d620c690803ab517f0b0b21a842682fd8a1659126bd4626d54913b0ba87cd041d7c27d83311205aecbf17a9dd4791a0d10fd9c8feffd079bb3f7419af28ddbed86118f62c9084f9cf296a7e42f6a475dd052ad39292701d8037c639f2a7af90fe0818d81696ae1c56ac8b43e81d779cc0ee8e1def948d51e3c709cdf826f8f5e5f837b25d134bedce57f369ebe38a08e2cc79d06ca2813e9b105b2386ffd12736df3c103d659133783dd03467d83ef43dda64934b965b1a4286f760ffac5ee53a7ac10645833b330c5104f9392bfed9dfd8b2a0eb5707c08c6a8fbd0c40ef9a65529d0143b19742d2429b96442ae6c2b4efa516c82bcb1355318d42348ee7616f02f7e9a558817002dd56ec1e154c674c512c99e9d72bde3b59a9709cf8fba6b957ff2d8a5e487d228ddd7f103a5143a2ddff07b7d7f9b6bdf8361f5e0d22297954e587ec6279b9ab0d03504e85316df34feba2410174d810cd4ef6858b931927bb6cb4910ce9d6d22148a67570dbcd33641cef573db646c4c0f54ee319a1448fa0081c46009d16fecc1d58bbf8c6f58e1f8e8332c9936dcbb6312a656b38247db8893634559622c6d69bb53970f9185a3a7c894470f5c7fa085309795067700ed60e208ab0acac77a641cd07f43d362477102d58c58bc0a5f6b3fb0b16399a70817822440affd09d9d89de6042d73ac2f12ed3605fc3890c7df09ae86ac7c58cda58c6eefd1770ec159da9f6ce0f15fba74be455d2d6885cc86fdf666e204305614cb3d71391ffd186cc10ad3bd07dfe2dad2b70faa2cf48df330a6c252bf2618fb46d0a5a030c505d99fce556dd45a2870927a1670a373f68cfe8643a54becfffb8f3a5fc52e3e31beee748fdab6bca8d4c8371e723bf2ff5d2033e3274e9396b3c500077989305dc6ac28674ba82546978f71c267a584662d5bc7199b79f669705bb23c7b362872634841109e10529a89c1bd8a473266a9d109e5ce911e7207302932ff29d4c74754c3b26f0ed386e9cf3edb518128063716439f3f0ea132e6c396d40a4b34a289950afde851f1c66fa51e4c4c5398af0e8b110ce417a1e1a0f115c48f1834bc6ecb26863275f059fe16da46d4a0769f7e3768d5645a34990bcbd81679115e2e961b1a90b6537f02bc802281aeee41e5a5133d8519cc645d08b3ee0ed083d7511d475773542f7d0e206a67c88c57d683dedafce8bccc83c58aa70ae7022d70d049654edfda0a1911fec9992cad1ca8e4d8c8c8be0449454b3b9bac6d1ba64564cfd64f24d8f7627c73862f427fa3e568b4bebc8dfb89e33d739f1556985d0255559c32441a2f7aaef523956bc989fd43fd62cba0fb42308c0865d3d18b28b4547a343961f38b6455b3d5269c0d639521d69c42f44c8357ce866a949fe522f114c80da2032baf67832acef6c26d4027f0059c3b61b16a99cd4e020863a6af800519cadfa81b769c448968865cd3ec97d4419e63bb8da976deb9e11f85509e68f0039b08e81838bd7c0a0da1656f351bbd99d6cccbf44ffb871a3ea56230acf71abd43fa42b38d79946ff6eaf30b09149f3027f6de20d1874ab4acd8569a036597dcb87968c8ad2b3e3949ec68156bb33d57475bb4c2df3b6f25ca070b65cc19c1519ad39b7b0c2928250e52bc18489ad357007c1176981e7a78ba57d5e2b069ea41538c11fad0e40bae06192bc63bd0f9e2532276e9661b7aa9845ef430f8c82e01ecd75b7ab1fed961d09cf144c71ab3b19b671d89421ffb0978d62d169693f2e782c5aa40f5a89e6516db56078aa6574223d5bb9ea5a5d0f38581333da4699a534ddd4cffc2bc335710bf93abd81529d623afae3a3ae8a375b29a8586a8b3df290550d2c9612f5faef8bd700778a4a007473a48f6ba6aa43fa0e1abb0a3d7a553a3d4b41de6156a2d398bf1b6c95b05a6cf4fde59546f198585ba7a0c3fc5826b56ae2853112a85618e"})
ioctl$ASHMEM_SET_SIZE(r0, 0x40087703, 0x4)
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
symlinkat(&(0x7f0000002600)='./file0\x00', r0, &(0x7f0000002640)='./file0\x00')
openat$ion(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ion\x00', 0x0, 0x0)
ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
writev(r0, &(0x7f0000000500)=[{&(0x7f0000000080)="6df5fc0d48ea4d69", 0x8}, {&(0x7f00000000c0)="ab4b450ddab3eef493d4045cc15bf6534d0bcd4f0c8d21c511bf9e4bd06f7c3febb3936566ffb367fdbc3bce8b8fbdb667e7443456d9439b8ac316617304", 0x3e}, {&(0x7f00000002c0)="4bef5d62440e3a723887fbd058d1d5301b75511735ad8256b35a92f3f9f65d0b5b3f2968c5919e8347b9cec01a4e5b4b4c0c1dfa3646569c991557934717884ab2dc6b39e6793ebec0f57b178fd0566fbaa48469205e4c2b0c261cb7d48e83408252951b79c7cb8385b0a22ee777a664d5a600f2d1ce646f7f667ccc41e93462c55c4c2e5a7ee0fb5a", 0x89}, {&(0x7f00000001c0)="0dcfc85cdf0bf4940af986364c31c9a95ae259deabf8d431438e56acc320285a2c408a7861b7bc98db5fe086bb861cc622b1fd395695831c69cbe63a2f9896f9299b391a", 0x44}, {&(0x7f0000000380)="845f297fcd297d164d95a93e9ba29a2a692c0798a8a17e2bae7681c834182de371572f4cde30adc04eb7a8492521d5316a3284bdb6ac14dfbebc8ce0e478d67212a59827cc0000f3867580e5ad2e28d8486f50f1b528e48527c7", 0x5a}, {&(0x7f0000000400)="b6f27b4b19f8bfa68dea1cd1dcfaa0ed8c0824401ff45207bbe9c08d630b8e1612ae270a214bf404598fd1446d3a38da43fcd79143c094c696dd941f195f8a159ddb8060a23e42855ec3c7bd40f06486ed3c0994abbd09bbff2994495bdf747df4f909ef980d3caf5f1b546067f5b744e487e9a3015d8271796d50e6830f09c0daa1ee1bea8e5b2638869284fdccc874941056f892d475a01039d947cd9dd4bc8b71a3aa0f51a35e1bb03e94d761026ec25db4ec4fb98908423ceabe7442e6ece698144c016119733837858319e2cddd866430fe023fb9bd7b6ea4b0163e99", 0xdf}], 0x6)
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

[ 1748.572339] binder: release 13113:13116 transaction 442 out, still active
[ 1748.581902] binder: undelivered TRANSACTION_COMPLETE
[ 1748.592098] binder: send failed reply for transaction 442, target dead
[ 1748.622754] binder: send failed reply for transaction 444 to 13130:13131
[ 1748.631030] binder: 13130:13131 transaction failed 29189/-22, size 0-0 line 2896
14:03:57 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0xfdfdffff00000000, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:57 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10a]})

14:03:57 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}, 0x2c)

14:03:57 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
r2 = dup(r0)
setsockopt$inet_tcp_TLS_RX(r2, 0x6, 0x2, &(0x7f0000000100), 0x4)

14:03:57 executing program 5:
r0 = msgget(0x0, 0x0)
msgctl$IPC_INFO(r0, 0x3, &(0x7f0000000200)=""/4096)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$admmidi(&(0x7f0000000080)='/dev/admmidi#\x00', 0x7, 0x0)
ioctl$UI_BEGIN_FF_UPLOAD(r1, 0xc06855c8, &(0x7f0000001200)={0x5, 0x1, {0x57, 0x6, 0x9f9ac1f, {0x7, 0xa2c9}, {0x3fb, 0xc5}, @period={0x58, 0x80, 0xfffffffffffffff7, 0x9, 0x0, {0x10000, 0x5, 0x100000000, 0x5}, 0x7, &(0x7f0000000100)=[0xa579, 0x2, 0x1, 0x400, 0x100, 0x1, 0x65]}}, {0x51, 0x6, 0x4, {0x4, 0x9e3}, {0x20, 0x8}, @ramp={0x1, 0x75a, {0x2c24481f, 0x8, 0xe83, 0x1}}}})
r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x8002, 0x0)
ioctl$KVM_ASSIGN_SET_INTX_MASK(r2, 0x4040aea4, &(0x7f0000000040)={0xfffffffffffffffb, 0x1, 0xfffffffffffffffa, 0x1, 0x9})
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:03:57 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}, 0x2c)

14:03:57 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11e]})

14:03:57 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0ab71aaf74d140f3a73ee4e083e42cb833dc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:58 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x40, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04"})

14:03:58 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9]}, 0x2c)

14:03:58 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x40, 0x0)

14:03:58 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x140]})

[ 1749.469756] binder: release 13156:13157 transaction 447 out, still active
[ 1749.476778] binder: undelivered TRANSACTION_COMPLETE
[ 1749.488991] binder: send failed reply for transaction 447, target dead
[ 1749.517880] binder: send failed reply for transaction 449 to 13160:13161
[ 1749.526474] binder: 13160:13161 transaction failed 29189/-22, size 0-0 line 2896
[ 1749.552844] binder: undelivered TRANSACTION_ERROR: 29189
14:03:58 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x630b}], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:58 executing program 3:
r0 = accept4$tipc(0xffffffffffffffff, &(0x7f0000000000), &(0x7f0000000080)=0x10, 0x80800)
ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f00000000c0))
r1 = syz_open_dev$radio(&(0x7f0000000040)='/dev/radio#\x00', 0x3, 0x2)
ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r1, 0x408c5333, &(0x7f0000000400)={0x5, 0x5, 0x8, 'queue1\x00', 0x4})
r2 = syz_open_dev$dspn(&(0x7f0000000100)='/dev/dsp#\x00', 0x7fff, 0x0)
getsockname$tipc(r2, &(0x7f00000004c0)=@id, &(0x7f0000000240)=0xffffffffffffffbd)
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f00000002c0)="0adc1f123c123f3188b07056202fb6ca4298a292f88c6dada94b66f75d3d947336634fecd894dd418f04851fb6b3646d369c31a136ce74cf85786b54f699f9810ce28d66a3130721ce113bd2caefe4678014424b5f00a77fd72da61681795144aa76cf9b95313220253dcb6103c9fd36")
r3 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="021600000a0000360900e14bbb5f2c905d1084a337b9b46b6e0008001200000000000000000000000000bc0000000000fe800000000000000000000000d1d3070000000000000008282c548fc9df110000000036d83365364dd90d0000000000003e5010003ea704f709bdceb89f2103870c756460bae4f5ddbc739de44a4e16d82a9b2e3a00000000000000"], 0x50}}, 0x0)

14:03:58 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}, 0x2c)

14:03:58 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x0, 0x0)
ioctl$ASHMEM_PURGE_ALL_CACHES(r0, 0x770a, 0x0)

14:03:58 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb]}, 0x2c)

14:03:58 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x174]})

14:03:58 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000000)=<r2=>0x0)
write$binfmt_aout(r1, &(0x7f0000000440)={{0xcc, 0x4, 0x8, 0x18f, 0x322, 0x5, 0x115, 0x3}, "d3f328981432c5eeb6be0320c1e47c064170a7b87cfaf8c931c90bac95b2b520fe20b58e2f33f5f6823433ec7a", [[], [], [], [], [], [], [], [], []]}, 0x94d)
wait4(r2, &(0x7f00000000c0), 0x8, 0x0)
r3 = accept$inet(r0, &(0x7f0000000080), &(0x7f0000000100)=0x10)
getsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffff9c, 0x84, 0x0, &(0x7f00000001c0)={<r4=>0x0, 0x7, 0x80000000, 0x3}, &(0x7f0000000200)=0x10)
getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f0000000240)={r4, @in={{0x2, 0x4e21, @loopback}}, 0x6, 0x5}, &(0x7f0000000300)=0x90)
r5 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000eedf000000000000000000060000400000000000000000000000aafe8000000000000000000000000000008365e90b9d2e311af469a1f35672e82b1fdb0448dcea0b742dc9470ab660a5977f34b2a53c9a0fab1b9268361a833c0d71a1db9d012a9ddd24f01bbaf00008efb91f24608025b8f226562773733a85d6f4da5ab1776df736c1876145bdf6683e52ae2a27ebfafa5fe2401468f2d7fa208d39e1a6cd4d9feadd6a2e2e8b751f558e1d6a013e40c7df18059b772056ced638ccec37bfb363e5300048bd89e971bd5ab9cd065200c53764ea0a4799e9783460d853"], 0xf3}}, 0xfffffffffffffffc)

[ 1749.707971] binder: 13208:13210 ERROR: BC_REGISTER_LOOPER called without request
14:03:58 executing program 5:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x755, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$FICLONE(r0, 0x40049409, r0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
socketpair(0x10, 0x2000000000, 0x5, &(0x7f0000000280)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000240)=0x80, 0x4)
r3 = semget$private(0x0, 0x3, 0x60)
semctl$SETALL(r3, 0x0, 0x11, &(0x7f0000000140)=[0x5, 0x5, 0x9, 0x9, 0x7e7, 0x3, 0x9, 0xffffffff, 0x6])
clock_gettime(0x7, &(0x7f0000000500)={<r4=>0x0, <r5=>0x0})
futex(&(0x7f0000000000), 0x3, 0x0, &(0x7f0000000080)={r4, r5+10000000}, &(0x7f0000000100)=0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'veth1_to_team\x00', <r6=>0x0})
recvfrom$inet(r1, &(0x7f0000000380)=""/160, 0xa0, 0x2000, &(0x7f0000000440)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10)
ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000340)={'vcan0\x00', r6})
setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000300), 0x4)
r7 = open(&(0x7f0000000200)='./file0\x00', 0x121800, 0x10)
write$FUSE_LSEEK(r7, &(0x7f00000002c0)={0x18, 0xfffffffffffffffe, 0x8, {0x100}}, 0x18)

[ 1749.753052] binder: 13208:13210 unknown command 0
[ 1749.769715] binder: 13208:13210 ioctl c0306201 20000100 returned -22
[ 1749.811483] binder: 13208:13223 ERROR: BC_REGISTER_LOOPER called without request
[ 1749.832412] binder: 13208:13223 unknown command 0
[ 1749.867631] binder: release 13208:13210 transaction 454 out, still active
[ 1749.875554] binder: 13208:13223 ioctl c0306201 20000100 returned -22
[ 1749.883409] binder: undelivered TRANSACTION_COMPLETE
[ 1749.897551] binder: release 13208:13210 transaction 455 out, still active
[ 1749.919529] binder: undelivered TRANSACTION_COMPLETE
14:03:59 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x40, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04"})

14:03:59 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc]}, 0x2c)

14:03:59 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008913, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:03:59 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x175]})

14:03:59 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x630c}], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:59 executing program 5:
r0 = syz_open_dev$adsp(&(0x7f0000000400)='/dev/adsp#\x00', 0x95, 0x0)
ioctl$EVIOCGUNIQ(r0, 0x80404508, &(0x7f0000000440)=""/19)
r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
r2 = dup3(r1, r1, 0x0)
ioctl$KVM_TRANSLATE(r2, 0xc018ae85, &(0x7f0000000140)={0x2000, 0x100000, 0x5, 0x8, 0x8})
sendmsg$kcm(r0, &(0x7f0000001880)={&(0x7f0000000480)=@pppoe={0x18, 0x0, {0x0, @link_local, 'bridge_slave_0\x00'}}, 0x80, &(0x7f0000001580)=[{&(0x7f0000000500)="ecc94a0555629bba8ad20d2f4d3fcdef9a4e8809eb57a913688ebe34af71a553b0557ff2a40860657b4fbc994005f7dd0eb3ac0c2a85d9cebf96b74f28f33243debc07653e2e36fb1f5036df68d3a85fe42aa1db4d1cabd0e15120965d3509ba09533d3dbf144d4246616e89a4a07b9163019a765e1799c7bb76d062", 0x7c}, {&(0x7f0000000580)="444f17aa107a914ae79d1576f620846db50de77c6df55a99b2d8db3ec9216e9cc45302f0a2ac27af8ea5986b6a939e3702412e6170f04f86cfde472a7a883b5c0d2b93f42dc14c78665e8a79301022f800dec2d17e58cddc96be8f15443fd0537b3dcdb04ec02d730f737af0d0ab5d3f31850e041859a4f92363942e44db246eeaddff95da421531a09c053a95e94d286cb678db7d7f46cbf98fcba877672456ad1a278b624d8f0000e123a27e60de711e5803a9ed318786dacea755d54ce4dd04ed6d279d7938f4c7d6c08b12edaa48e4b4bb04df9b1bc05c55983df96628f0c343d4c456736d90822093e3b22bae837414a86572025cc430f9801351539a465e0403b4299da4fbd85dab7603f3866c8857506c38f14f1431081d11e67d28b97b523851f92bdccd48aecaf9583aac70bc84a8e66e288c0d630c6f7cb84184a44a982f2acac76728472c54bf667b537f381ce126d3e2ffbdf818638e966f2255aca8dc98f5a769e74e1af37fe2b5acac3b3ed2e5c6921044e949c0c3dd8ece45e4c121f5c9de72d134b5a85c0d9b7d37b9b5ecf11e0f4eaf9360eaa2e11182ace3004b1c67b907a4441f82e9bb4ef4e9fc346149ac6bb398b747f7b650ee22e333329f620cc6970dd22a401c9b9ecf81e64f517e90908af16b6e95d6dbc19e2634aeffc15a4236d54a2e62c88b3834188a12ccdeb0ae1d81f811dfc89224d10233ca939b097b63c13f7fb51a54564b785512b00fdeae7773ba6f14fa9ef626ca4a445fb5ab67284a33823efd79b926889da5f4139e16d6adaf99ce61568d43667910c1e6a68376cf54c47af92059bd15084c32a689e2602fe3befdb76133aa98cf4fc6f1a1642de65b0d8f59af1bdcd7629324498d4f411cc02a58bca0515271003d2f7592ee419fe982b42a567bc6d186122292e5186442af7be022e448f88b634ca919b26b88b50d1eda1bb30309838aa6d2ca7434959e63d335c6288ca16f27cae5af09dadec30c3238c761ad2e54694236b8bbb0c0ba70665884f7c00dba5fe5e52bc1a5c12b8d70a92bbf28ea0addad897c40a00d306516d7da2faf8ee133b19d2f2c3fae1e631cb35e287195ef5b377481cc91013d90e6d58a6639345065c2394e8917a33f497bfa27e8493f0a7e06493f51c627849fccc03864a1aae9cb726a4b870ca659ce427c818d0511b87a227534e80347a6c8d4d8cc4dba9f1c190b005b442edd388c8e3401aae79f32f01fbcffe2f0795fef791e75d7d7d4582a9ae51d756a1d89ca8a23b0f64cc10ff5a9239d9d1ffba5ab59fe6d6cda1f1169b53ded594d40ac6e043b479e38c830a744737cfcb22881ce70ad718bd558b52b663ec771de1ce4b85653177cd538dcaef9afab421a1ec80cccf5155530f212158a37ff972e81f47019c2651f75f8c66f4bd6033b1055558c78138a3c42d4ce0b28c9f0354845524fe800932824998b1595fb4a9adfd866665ad2034c4b54c921fb998048649fd468d002702836ba1aa0b640cadf14080eaddf51d6e8866f74b87ec7a481889c72b302954b7098ba34fb97511bf9a48d9f6aad0a0fa55e0745830ebe7faf4cc587267dee2c229933f52eca1bdf0abba198a8a188d3f8d0b2ea774fd568660b3aade22e76982ffd5f72fe1eae84344b17cc2298eb793e3ab33a1fb68fca2013ee506926531fc72aef275d9c5cc6cfb97c246b6cbb9c7b48d097806e3614e12a99848e5dca5c8c68adbb494fb0cc17b2fadd0e1112f369ce463919dd6e429984b9084ac1f74b901b017825381d1d18fc70316f503ba7ae17005b131965896ec4c562746694c68e46c55f74ddf23e25cbe7a82684af291fca94c155fa45052479a2e5989e2134b07a9fbe0b57b45530081f0f3ac055fa3035f019ff85e20270a140967f560a11fed3914d2141fa08458fb801898bdcc4fbfe79ede698c67d5ba8c3f0bb1e0c32813a4d637cf7908b10b18a556dfb07556556ea98b76819a4f6adfbea14a3c9701c37db31f0c08f262e8e90d97aa266da3adae62be569693690dba5e50e9f19797e4ff32e5d95ea78cd67b9b62442f2a0da664609335ef7a0f4adf209b2a06d66841b7ac1b63d6e18045b8988fdadd3a13461c1d8562e6d2536343cc56731c209402ade3ce33d7a0c6295296562482e6426b02d6b2e6225766b59a8de36aa97dadf7648a8a08696613c974593d322d7209ce7fcf0c6b3a5641d41b0a0ff799c2bfe58a642bb05a6871f4341afb28eb37764a38db54843574b83b2fd9029fd26756f28fc6065d6891e12c5f7cc0f93e14754d3a19c76eb3130518ae108ea891e04e9958a8f82e2e2615d340e294b8d22597dd6046e5e1578d8efaf85f226706b308b1f718a4ff833f8b9ffbca8c96679b2f68cac93afb86510afca0143db0feed773f40fe2c3368463db1e7a109319afbfd78694763c1b149ac592eedf34136e153a0d5c75d34e3d025c96469bab3a7365373605f1118ca5d4243e096bb67445039e94d3bff605b3a1714e015f5d53ab0043f365fef372079b1f50e5928bb568f58e15d88a078a29f430e77d144bf2461322b00dc816d69b788bd51cd4f19d7f64884aa24640767fbc17181ebeb1116d06fa4592c01f2a47400bd94c8b70aad94493661bb3ed65607047f3e46de064a4d48d7084107aca60f8e2d7286b33a35a708e19321679692956fc3833088d99b23dce7d56df89c7e707db0019a7c86cc1d3d31d940fc6126aa9e10fbfc0b37c6b9c667c39711031faa499f9953bffd478778587dacdd4aac1aaa067cc8aceb8d4e9d6ece2f57b8ab3df0b9e0f362e9f4b30fa24e9116ecda6254b4fe85cdb3c68d36c24a513deecf234af57815a3e74ab909d1268f6b2a0b2d363b418830e1d4e80dd85c0b828603b437d173310fe77cc2a503721c293deebd503d9070ad57d56425cd41e0be8ff2b1ea223f130b4b858cb2e9d71c40584ef9fd3155d1982c43fb3c54922f874ad9cb6f053dd86ef741bad30d88175fe9a36a9d5343faed49f0e00f5c0d1491613dcccc9f0d21a17783e844bd5182597112b9d8f286bfc8d0bc3f7578a0af8c91ecd4698acd832822ac4b19675c011e4304f074b1dafcc357be3267661d2dd521e5eed5bdf9fe8bedaf1dbc562dd9f48994f0d6990c5a4cfe11bcc4a262450b806db1235826fb614ecbcbd7e607c64d75eeb11131ac85ac351f8c906fe934826e6a596d5d1420ecd466cf4f3ddaff40c11e4ac346b004ac1b726a11c49a617ae18b1619e64f7f492fcf4c274ec6883efadc41662f727c729ae36a3b0e5ad5edea878b067f1b93c1d4393904fb84af259260188b5e8be9d6a271d9001338f8250ab5913dedc81148dc8c7dd48990919fd274f0e04f2b23bda9b755fa196d674e8053556fabbc7ca643c949c15cd4ad9d43f070db447041d0c5e8b6134599e2ffc3289b772abfd5c9a0c6f4c41fad04b6f49dbe45eb76a8a44ef30bff72835df3b2c705ae197a820760fc0768c9114c043b38ea6e1404c804d63af7e4b49725769a99132e592fcf9482951aae67d3d9eb9e25dd74b688afc4fc72a8b3bd43f052cbf66c7112dc290c78524cce69b0d5a5b918f87a69592f58a38e3d2702d4ebf2607b57ea5c9a7001f392fab29f6167bc26fc251c96aefc6ac66e6caae56e2e30da28dd0b5722d566675df30c89af61c2b84cec4004f4e94788617ffb5f5cc28de4c5ab0df3643fc1115b7baa269294123037ebdc7f7608f31dc48a5630852327a396bcd253802b1b2a6c5c596c2586a52d3da393002c69c48ba7ff17134d832d9005eaa30a577b8d56429b9fea51da4b4ecd15dccd0c57f21d9c0359664f245f90c00cc383b3e5afe5f9d6097789d337a71d5458f20467dbf840fb5365ddb2ad31f7f5896b35a64f98ce7fa53646f09689546215a508e8a040c20a834f17506bc8728f684239b0c271478c100fbe624367bc6b1e4c1f9f70caaab9a2eb9785f78b97feb66467e50cf7c13a8354dcd965976141f0f6b6e76e13b057ad24e47cf819d82f7d3382103b36924642a2abbba42f9b3a1eb7dccf1a75f3ee62f5ce31d03d11aa395425e1bdbe57a0bdc64ead939c3f88f1ce08104b438b7d4044881d859d4651c21bfecf28c269ebc91cb8b41df3f50cec44dff2b60e94a76ab44213612cb84422be93ee3e0db4bceaabb273259da881392ee42e2e0f3f52bed8d286e4f0effb03a4de55348e9b708ce9f7ef06d491a04beea7618f674be3ef66eed8639b0c8d00156ebaab9542125828137b06adb2c33a09bd066c285ed1b53f2936b3cf24db8cd58ad2897735962a2053ce550976b87adefaedffc57d36fe936db2150a6d6a7498de16f06cc21372c427abb13075f602bb2c6cbb47efa5ff2a7a5363feba8fab10b64b7a032e5ecf70fec00b1df74cd605e3570cadef460396a30e779a8c0c5cfad0d9377cc2c25813cb63eae9359c1382837e954beb7eb392b2411e0ef429d58c3e0a03de3e3e1cb1ac443471c262e871085985972f04d1373af98e46d0f0540f2a366a03f1a1310a1604dbbe08f8491797eb769f8da01c476e4057eb48b6849d5eb54f898ae979516cf4b72cecbc7a79add162f908e1a1021d1f82ad916403dc09c29bfbb3954014fd93f5a14e9f8d2c7f333653945925a5bb410b0c8855dd81853a6cbec3febc1719648570e4f198992d8ce0258a9efc6954b35f15064a3c3eb4aac3f99b86be8876a559325ec65c88f0aa0f416825895086d4dda925ff6148616c0589b794ec361b10dcc860d034b409669c3c0da1add6d16a988dad5f8f1fb6a5c85439ff55b1f8e66634059a486c8a41a3e22665adff99c2ef82e7ec007b67907656866ec3906c27e87f50e5109c73ac1db435db62f12ea46e0ca13fa67a81438027ed71a78ce2df192980efa830de44bc6df25496ff4be631ed68425c6f0955a9ce403b765af501ec97643a748cad99f8caf6cb2e016ef2920d7ebed87938d693dce4d1fe69c62b0377aa7db8e3cecfc130a31e5982286ec0bde5614e211abd30fb107ef4e818d0deb38dc184c1bfa349ac0182c79eadfe55657be89676ee520b7b960778e4486b87e0c54228e3a044021fdd7aedad50ea3065bf6edbbb33ac4f4153c05dacdb9d72907c5ff91e5edd94645b7cc4057cded00193eda5bf8692ddc1c237d2019526641f36283e89fdb67b458b2892b3741de0d39e8a2316738abe6605a939d59b5af35588faa72ce822d8660c75894de3d01692ff0c05d6e7edaf4c12f55c61c139c25559774589d19de16f6de1085a9b6a799525ddda891a05b17f305a78625326df67897bd4dfed9ea1854cf3ce28ac0310d0b149c6b296b1783709137cda45a3745470572fe0c2ce6db2d1b60939535471e4780e7ce31a28d3b2d1d4286f96f42cc9a63e88e61c915cbeab2cc6633870bc176a126ed376ff2cc4858ad43483552b3221f6624458515b146d471995f3db092944d91e22a63c3fb5b52d8feb31568b8ef53c9b5aee69ffd39a896608edd69a0af649e18e58bb9c68631793dd7a025fb4f33c76d33c76b85860ce9126b4e44b7a597256f324c1a006cc49b11958cd404f99eb0323c082cc268b8f09c0ba78f41954fa331898edac8ffaf8aba46ec098877323b00f4d7429bcedb0cc2ddc59b76fb4e886fc3fa9f21b6ec3930131019e7f3f7e4a64cabdf7e7e4de4a123542b9c75389e74c6063e527f400943a40847271c5d1d63a6eb475ae026c149b7eb3b0159416c1b12452e64b348942fc186c7df2d4104f4b27d696c61778d36455c8e", 0x1000}], 0x2, &(0x7f00000015c0)=[{0xc8, 0x112, 0x100000000, "515082041ee9f0c7d7fca238fb39c4337156299e0fa6fab1aec2e3fe65ba0efc10752b3970dbcece2676ce2d40ebfb859f20460e0435db6182f6500529f617ee9cc8a27dc7b1ba121a2579deb3aa631dbcf67dbad99a3653537f25e6fd9a2e9824cd500bc7265f73726d18d81b9e701f39932ffae75a636c00fc42fe6d92bd55e2d0970795e1891e63d52080ccf0e28734ec23c6528e346921b45fbe4cfb251543068fd97e36274b2aaef8d43f177171f11d53cf9629"}, {0x50, 0x100, 0x4, "56d28a842b1fab6cf6f48d9f19d8d5e880a6717717dcba8be280df088936eddd5c54109098cd990a35f05c2542c3cd3de568201a3d0ae995950e945c71"}, {0xe8, 0x102, 0x9dd, "b9c90c84a13ce75f5c97a18a135cdf5a6c3470c8de1f6ab69d2f110db326978aefff5ff94f43432fbcab213e0d715b62a4eb70c6e46ac76cbaaaf79396a4764de002d1902a9efa5d3f43a3b5e82a05e66ed28cf7f2996f70199c20fddfbb6804c6f95897fa6c49b6629d9da950c3376ec86ab11a528587f18382c49c094a0bfe36ea94ce219bbf837ffca5adc715d7295b51f90ac782ad2f3c568ebfc1fcd4a73a6ba85e677459faab26feee6874652b1abc6f51adfd46f616f27fc866540bbbfaf8c9aef6e4e61420d3cf5035fbd1bc8c4ea493"}, {0xc0, 0x10d, 0x12a7, "e495f8caa2f8ca0bde213d5d04d41213117cf4e04eff4f131221b13641758c12aa55aa2008954fc83f4e82d42ff16053fad24f29aa840e7bb9b50430fea3393b93f5ba80c95a6b10df9c2d1ff955fc3d38948fbad60b235cfeaf16f08adac8c41c79a70c41f9e0be7ad5cfb751096f1c811a4d467bef7d625d2d947dc026a71f690c502a64ef990f28431aae8e7d4c032cb466930be175f0d2796c78773a059c0856ac9ff2a5ce0087b89ffd8b40"}], 0x2c0}, 0x40)
r3 = socket$inet(0x2, 0x7, 0x7)
r4 = semget$private(0x0, 0x1, 0x20)
semtimedop(r4, &(0x7f0000000380)=[{0x4, 0x1, 0x1000}, {0x1, 0x400, 0x800}], 0x2, &(0x7f00000003c0))
ioctl$VIDIOC_QUERYBUF(r2, 0xc0585609, &(0x7f0000000300)={0x8a, 0x7, 0x4, 0x2000000, {}, {0x5, 0xd, 0x4, 0x5, 0x3, 0x20, "28111971"}, 0xb974, 0x1, @userptr=0x2, 0x4})
ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=<r5=>0x0)
r6 = accept(r3, 0x0, &(0x7f0000000080))
ioctl$KDSKBMODE(r2, 0x4b45, &(0x7f0000000200)=0x7ff)
connect$inet6(r6, &(0x7f0000000100)={0xa, 0x4e24, 0x658, @dev={0xfe, 0x80, [], 0xd}, 0x689}, 0x1c)
ioctl$sock_SIOCSPGRP(r3, 0x8902, &(0x7f0000000040)=r5)
timer_create(0x6, &(0x7f0000000240)={0x0, 0x31, 0x4, @tid=r5}, &(0x7f0000000280)=<r7=>0x0)
timer_gettime(r7, &(0x7f00000002c0))

[ 1750.379853] binder: release 13197:13198 transaction 452 out, still active
[ 1750.386875] binder: undelivered TRANSACTION_COMPLETE
[ 1750.397715] binder: send failed reply for transaction 452, target dead
[ 1750.414891] binder: send failed reply for transaction 454, target dead
14:03:59 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, 0x2c)

[ 1750.440412] binder: 13241:13242 transaction failed 29189/-22, size 0-0 line 2896
[ 1750.457613] binder: 13241:13242 transaction failed 29189/-22, size 0-0 line 2896
[ 1750.477061] binder: send failed reply for transaction 455, target dead
[ 1750.486964] binder: 13241:13248 unknown command 0
[ 1750.486979] binder: 13241:13248 ioctl c0306201 20000100 returned -22
[ 1750.501468] binder: undelivered TRANSACTION_ERROR: 29189
14:03:59 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x630d}], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:03:59 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}, 0x2c)

14:03:59 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe800000000000000000000000000000fe800000000000000000000000000000"], 0x50}}, 0x0)

[ 1750.602712] binder: 13260:13261 unknown command 0
14:03:59 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x176]})

14:03:59 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
io_setup(0x8, &(0x7f0000000000)=<r0=>0x0)
io_getevents(r0, 0x488, 0x3, &(0x7f0000000040)=[{}, {}, {}], &(0x7f0000000100))
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

[ 1750.631095] binder: 13260:13261 ioctl c0306201 20000100 returned -22
[ 1750.663080] binder: 13260:13264 unknown command 0
[ 1750.701965] binder: 13260:13264 ioctl c0306201 20000100 returned -22
[ 1750.714513] binder: release 13260:13261 transaction 461 out, still active
[ 1750.732937] binder: undelivered TRANSACTION_COMPLETE
[ 1750.738103] binder: release 13260:13261 transaction 462 out, still active
[ 1750.764198] binder: undelivered TRANSACTION_COMPLETE
14:04:00 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40046302}], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:00 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf]}, 0x2c)

14:04:00 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x17a]})

14:04:00 executing program 3:
socket$isdn_base(0x22, 0x3, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x100000000, 0x84800)
ioctl$DRM_IOCTL_DROP_MASTER(r1, 0x641f)
sysinfo(&(0x7f0000000980)=""/152)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
socket$inet_udplite(0x2, 0x2, 0x88)
r2 = socket$key(0xf, 0x3, 0x2)
getegid()
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:04:00 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:04:00 executing program 4 (fault-call:6 fault-nth:0):
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1751.289965] binder: release 13244:13247 transaction 459 out, still active
[ 1751.297011] binder: undelivered TRANSACTION_COMPLETE
[ 1751.307170] binder: send failed reply for transaction 459, target dead
[ 1751.327608] binder: send failed reply for transaction 461, target dead
14:04:00 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10]}, 0x2c)

[ 1751.346743] binder: 13287:13291 transaction failed 29189/-22, size 0-0 line 2896
[ 1751.370610] binder: send failed reply for transaction 462, target dead
14:04:00 executing program 5:
r0 = gettid()
r1 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000200)='/dev/dlm-monitor\x00', 0x0, 0x0)
setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000300)='yeah\x00', 0x5)
perf_event_open(&(0x7f0000000100)={0x7, 0x70, 0x2000200000000000, 0xfff, 0x80000001, 0x3, 0x0, 0xbf, 0xa00, 0xc, 0x8000, 0x1ff, 0x5, 0x5, 0x3, 0x7, 0x5, 0x0, 0x5, 0x9, 0x1ff, 0x40, 0xd97, 0x7, 0xffffffff, 0x3, 0x5, 0x0, 0x4, 0x100, 0x2, 0x101, 0x81, 0x7, 0x40, 0x3, 0x7fffffff, 0x4, 0x0, 0x80000001, 0x1, @perf_config_ext={0x80000001, 0xeb17}, 0x400, 0x0, 0x80, 0x8, 0x1ff, 0xffffffffffffff5f}, r0, 0x6, r1, 0x0)
r2 = gettid()
r3 = getpgid(r2)
r4 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, r3, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
gettid()
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
perf_event_open(&(0x7f0000000040)={0x2, 0x70, 0xff, 0x1000, 0x2, 0xffffffff80000001, 0x0, 0x71c5, 0x40142, 0x9, 0xffffffff, 0x1, 0x4, 0x400, 0xffff, 0x2, 0xffffffff, 0x3, 0x1ff, 0x3, 0x80, 0x1, 0x7fff, 0xfffffffffffffffd, 0x10000, 0x2, 0x7, 0x9, 0x4, 0x1a69, 0x1, 0x2, 0x2, 0x3ff, 0x7, 0x8, 0x0, 0x1, 0x0, 0x6, 0x7, @perf_bp={&(0x7f0000000000), 0x8}, 0xc0, 0x5, 0x0, 0x0, 0x80, 0xbfef, 0xe0}, r3, 0xffffffffffffffff, r4, 0x1)
ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r1, 0xc0945662, &(0x7f0000000240)={0x400, 0x0, [], {0x0, @reserved}})
socket$pptp(0x18, 0x1, 0x2)
ioctl$IOC_PR_RELEASE(r1, 0x401070ca, &(0x7f0000000340)={0x8000, 0x881, 0x1})

[ 1751.413673] binder: BC_ACQUIRE_RESULT not supported
[ 1751.414387] FAULT_INJECTION: forcing a failure.
[ 1751.414387] name failslab, interval 1, probability 0, space 0, times 0
[ 1751.419186] binder: 13287:13299 ioctl c0306201 20000100 returned -22
14:04:00 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[]}}, 0x0)

[ 1751.528579] CPU: 0 PID: 13298 Comm: syz-executor.4 Not tainted 5.0.0-rc8 #87
[ 1751.535831] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 1751.545205] Call Trace:
[ 1751.547822]  dump_stack+0x172/0x1f0
[ 1751.551482]  should_fail.cold+0xa/0x1b
[ 1751.555394]  ? fault_create_debugfs_attr+0x1e0/0x1e0
[ 1751.560517]  ? lock_downgrade+0x810/0x810
[ 1751.564799]  ? ___might_sleep+0x163/0x280
[ 1751.568982]  __should_failslab+0x121/0x190
[ 1751.573239]  should_failslab+0x9/0x14
[ 1751.577162]  kmem_cache_alloc_trace+0x2d1/0x760
[ 1751.581849]  ? kasan_check_read+0x11/0x20
[ 1751.586125]  ? do_raw_spin_unlock+0x57/0x270
[ 1751.586149]  ? _raw_spin_unlock+0x2d/0x50
[ 1751.586178]  binder_inc_ref_for_node+0x208/0xc20
[ 1751.586216]  binder_thread_write+0x13fc/0x2820
[ 1751.594800]  ? binder_transaction+0x6890/0x6890
[ 1751.608853]  ? __might_fault+0x12b/0x1e0
[ 1751.608892]  ? lock_downgrade+0x810/0x810
[ 1751.608935]  ? __sanitizer_cov_trace_const_cmp8+0x18/0x20
[ 1751.622630]  ? _copy_from_user+0xdd/0x150
[ 1751.622667]  binder_ioctl+0x13b9/0x1b79
[ 1751.622687]  ? __sanitizer_cov_trace_const_cmp4+0x16/0x20
[ 1751.636341]  ? binder_thread_write+0x2820/0x2820
[ 1751.636360]  ? debug_smp_processor_id+0x1c/0x20
[ 1751.636377]  ? perf_trace_lock+0xeb/0x510
[ 1751.649930]  ? mark_held_locks+0x100/0x100
[ 1751.654191]  ? zap_class+0x460/0x460
[ 1751.657927]  ? __fget+0x340/0x540
[ 1751.657973]  ? binder_thread_write+0x2820/0x2820
[ 1751.666176]  do_vfs_ioctl+0xd6e/0x1390
[ 1751.670097]  ? ioctl_preallocate+0x210/0x210
[ 1751.674529]  ? __fget+0x367/0x540
[ 1751.678016]  ? iterate_fd+0x360/0x360
[ 1751.681845]  ? __sanitizer_cov_trace_const_cmp1+0x1a/0x20
[ 1751.687399]  ? fput+0x128/0x1a0
[ 1751.690714]  ? security_file_ioctl+0x93/0xc0
[ 1751.695254]  ksys_ioctl+0xab/0xd0
[ 1751.698760]  __x64_sys_ioctl+0x73/0xb0
[ 1751.702678]  do_syscall_64+0x103/0x610
[ 1751.706724]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 1751.711929] RIP: 0033:0x457e29
14:04:00 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11]}, 0x2c)

14:04:00 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40046304}], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:00 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12]}, 0x2c)

14:04:00 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13]}, 0x2c)

14:04:00 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14]}, 0x2c)

[ 1751.715135] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00
[ 1751.734048] RSP: 002b:00007f5ab350ec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 1751.741772] RAX: ffffffffffffffda RBX: 00007f5ab350ec90 RCX: 0000000000457e29
[ 1751.749067] RDX: 0000000020000100 RSI: 00000000c0306201 RDI: 0000000000000004
[ 1751.756354] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000
[ 1751.763653] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f5ab350f6d4
[ 1751.770940] R13: 00000000004bf15a R14: 00000000004d0b00 R15: 0000000000000006
14:04:00 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x17b]})

14:04:00 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x15]}, 0x2c)

[ 1751.786108] binder: 13296:13298 Acquire 1 refcount change on invalid ref 0 ret -22
[ 1751.794769] binder: release 13287:13291 transaction 466 out, still active
[ 1751.805699] binder: undelivered TRANSACTION_COMPLETE
14:04:00 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18]}, 0x2c)

14:04:01 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:01 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/hwrng\x00', 0x3b, 0x0)
openat$cgroup_ro(r2, &(0x7f0000000080)='cgroup.stat\x00', 0x0, 0x0)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:04:01 executing program 5:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = dup3(r0, r0, 0x7ffff)
ioctl$UI_ABS_SETUP(r1, 0x401c5504, &(0x7f0000000000)={0x100, {0x1000, 0x9, 0x9, 0x1, 0x1, 0x8000}})
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
prctl$PR_MPX_ENABLE_MANAGEMENT(0x2b)
ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f0000000200)=""/135)
ioctl$VIDIOC_SUBDEV_G_FMT(r1, 0xc0585604, &(0x7f0000000040)={0x1, 0x0, {0x1, 0x100000000, 0x2015, 0x0, 0xb, 0xa, 0x1, 0x7}})
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:04:01 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x185]})

14:04:01 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}, 0x2c)

[ 1752.202794] binder: release 13296:13298 transaction 465 out, still active
[ 1752.209843] binder: undelivered TRANSACTION_COMPLETE
[ 1752.223588] binder: send failed reply for transaction 465, target dead
[ 1752.230729] binder: send failed reply for transaction 466, target dead
[ 1752.260782] binder: send failed reply for transaction 467 to 13310:13324
[ 1752.270718] binder: 13310:13348 IncRefs 0 refcount change on invalid ref 0 ret -22
[ 1752.270739] binder: 13310:13324 transaction failed 29189/-22, size 0-0 line 2896
[ 1752.333403] binder: undelivered TRANSACTION_ERROR: 29189
14:04:01 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40046307}], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:01 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500]}, 0x2c)

14:04:01 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
r0 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x20, 0x201)
getsockopt$inet_sctp_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f0000000040), &(0x7f0000000080)=0x8)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:04:01 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x186]})

14:04:01 executing program 3:
openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000000)='/proc/thread-self/attr/exec\x00', 0x2, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe8000000000000000000000000000009973ef7c9af0dfc2d7fc704f08f71bfddff8baca452269643fbad0909899aaa6c13bb8fc696a0c660dd6338fd9101adba68e3722ae16a695b4113282abc87d5a156b2e2a6bcf6fb5a55df8f3aa81f2f3202ee6373eefb85520a9768b0acd54f50a37d18255c3a49b496907c539727c1c3142c59f110792ddbddd0ed55787c5afb1dc2b523522d8a3c0a2070cbbe7e62beaefd9e17230937387cf86f90c7e464b5de6a9f00ab31ac1e659f40037849cb2b9e86f404fc6b8d887730ec407709da099766d9d27d5c627a2"], 0x50}}, 0x0)

14:04:01 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600]}, 0x2c)

[ 1752.502408] binder: 13366:13368 DecRefs 0 refcount change on invalid ref 0 ret -22
14:04:01 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700]}, 0x2c)

14:04:02 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x2, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:02 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x210100, 0x0)
getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000080)={0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f00000000c0)=0x20)
r2 = socket$key(0xf, 0x3, 0x2)
ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000100)=<r3=>0x0)
process_vm_writev(r3, &(0x7f00000014c0)=[{&(0x7f00000002c0)=""/4096, 0x1000}, {&(0x7f00000012c0)=""/129, 0x81}, {&(0x7f0000001380)=""/129, 0x81}, {&(0x7f00000001c0)=""/51, 0x33}, {&(0x7f0000001440)=""/112, 0x70}], 0x5, &(0x7f00000015c0)=[{&(0x7f0000000200)}, {&(0x7f0000001540)=""/123, 0x7b}], 0x2, 0x0)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:04:02 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f0000000000)=0x2, 0xa, 0x1, 0x0, 0x0, 0x220)

14:04:02 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x187]})

14:04:02 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900]}, 0x2c)

[ 1753.097896] binder: release 13349:13350 transaction 471 out, still active
[ 1753.105006] binder: undelivered TRANSACTION_COMPLETE
[ 1753.118471] binder: send failed reply for transaction 471, target dead
[ 1753.137924] binder: send failed reply for transaction 473 to 13366:13368
[ 1753.147342] binder: 13366:13368 transaction failed 29189/-22, size 0-0 line 2896
[ 1753.169910] binder: 13366:13390 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 1753.204024] binder: undelivered TRANSACTION_ERROR: 29189
14:04:02 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40046311}], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:02 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00]}, 0x2c)

[ 1753.224842] binder: BINDER_SET_CONTEXT_MGR already set
[ 1753.224899] binder_alloc: binder_alloc_mmap_handler: 13394 20005000-20009000 already mapped failed -16
[ 1753.243644] binder: 13394:13397 ioctl 40046207 0 returned -16
14:04:02 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c)

14:04:02 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = accept(r0, &(0x7f0000000080)=@hci, &(0x7f0000000000)=0x80)
r2 = syz_genetlink_get_family_id$team(&(0x7f00000001c0)='team\x00')
getsockopt$inet_mreqn(r0, 0x0, 0x27, &(0x7f0000000200)={@empty, @loopback, <r3=>0x0}, &(0x7f00000002c0)=0xc)
getpeername$packet(0xffffffffffffff9c, &(0x7f0000000300)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000340)=0x14)
accept$packet(0xffffffffffffffff, &(0x7f00000004c0)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000480)=0xfffffffffffffe6d)
getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000002040)={{{@in6=@local, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r6=>0x0}}, {{@in=@loopback}, 0x0, @in=@multicast1}}, &(0x7f0000002140)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000002180)={{{@in=@remote, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0}}, {{@in=@empty}, 0x0, @in=@multicast2}}, &(0x7f0000002280)=0xe8)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f00000022c0)={'team0\x00', <r8=>0x0})
ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffff9c, 0x8933, &(0x7f00000023c0)={'vcan0\x00', <r9=>0x0})
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000002400)={'team0\x00', <r10=>0x0})
getpeername$packet(0xffffffffffffffff, &(0x7f0000002440)={0x11, 0x0, <r11=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000002480)=0x14)
recvmsg(r0, &(0x7f0000002640)={&(0x7f00000024c0)=@xdp={0x2c, 0x0, <r12=>0x0}, 0x80, &(0x7f0000002600)=[{&(0x7f0000002540)=""/186, 0xba}], 0x1}, 0x40010100)
getsockopt$inet_mreqn(r0, 0x0, 0x24, &(0x7f0000002680)={@rand_addr, @multicast1, <r13=>0x0}, &(0x7f00000026c0)=0xc)
getsockname(r0, &(0x7f0000002700)=@hci={0x1f, <r14=>0x0}, &(0x7f0000002780)=0x80)
getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000002940)={{{@in=@local, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r15=>0x0}}, {{@in=@empty}, 0x0, @in6=@ipv4={[], [], @empty}}}, &(0x7f0000002a40)=0xe8)
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000002b80)={<r16=>0x0, @rand_addr, @broadcast}, &(0x7f0000002bc0)=0xc)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000002c80)={'bridge_slave_0\x00', <r17=>0x0})
getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000002d80)={{{@in6, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r18=>0x0}}, {{@in=@multicast1}, 0x0, @in=@empty}}, &(0x7f0000002e80)=0xe8)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000002ec0)={'team0\x00', <r19=>0x0})
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000002f00)={{{@in6=@remote, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r20=>0x0}}, {{@in6=@remote}, 0x0, @in6=@loopback}}, &(0x7f0000003000)=0xe8)
accept4(r0, &(0x7f0000003040)=@xdp={0x2c, 0x0, <r21=>0x0}, &(0x7f00000030c0)=0x80, 0x800)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f00000031c0)={{{@in6=@loopback, @in=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r22=>0x0}}, {{}, 0x0, @in6=@loopback}}, &(0x7f00000032c0)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000003300)={{{@in6=@remote, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r23=>0x0}}, {{@in6=@dev}}}, &(0x7f0000003400)=0xe8)
getsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000003500)={@multicast1, @broadcast, <r24=>0x0}, &(0x7f0000003540)=0xc)
getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000003580)={@multicast1, @multicast1, <r25=>0x0}, &(0x7f00000035c0)=0xc)
getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000003600)={{{@in=@empty, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r26=>0x0}}, {{@in=@initdev}, 0x0, @in6=@remote}}, &(0x7f0000003700)=0xe8)
accept$packet(0xffffffffffffffff, &(0x7f0000003740)={0x11, 0x0, <r27=>0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000003780)=0x14)
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000037c0)={<r28=>0x0, @dev}, &(0x7f0000003800)=0xc)
sendmsg$TEAM_CMD_OPTIONS_GET(r1, &(0x7f0000004180)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000004140)={&(0x7f0000003840)={0x8d4, r2, 0xe31, 0x70bd2b, 0x25dfdbfd, {}, [{{0x8, 0x1, r3}, {0x3c, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xffffffff}}}]}}, {{0x8, 0x1, r4}, {0x1f0, 0x2, [{0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x100}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xff}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r6}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x36fb}}, {0x8, 0x6, r7}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8, 0x1, r8}, {0x7c, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x7}}}]}}, {{0x8, 0x1, r10}, {0x104, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x2}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r11}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x1}}, {0x8, 0x6, r12}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}]}}, {{0x8, 0x1, r13}, {0x128, 0x2, [{0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r14}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x20}}, {0x8, 0x6, r15}}}, {0x6c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x3c, 0x4, [{0x40, 0xaebd, 0xfffffffffffffff8, 0x5}, {0x732, 0xf91, 0x7fffffff, 0x20}, {0x9, 0x1, 0x3, 0x6}, {0x9, 0x81, 0x2, 0x81}, {0x3f, 0x3, 0x1}, {0x8, 0x40, 0x1c, 0x3}, {0x1, 0x4, 0x5c, 0x80000001}]}}}]}}, {{0x8, 0x1, r16}, {0x4}}, {{0x8, 0x1, r17}, {0xf4, 0x2, [{0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0xd2}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r18}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r19}}}]}}, {{0x8, 0x1, r20}, {0x84, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r21}}, {0x8}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r22}}, {0x8}}}]}}, {{0x8, 0x1, r23}, {0x228, 0x2, [{0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'roundrobin\x00'}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xffffffffffff95bc}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r24}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r25}}, {0x8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r26}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x400}}, {0x8, 0x6, r27}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x6797}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r28}}, {0x8}}}]}}]}, 0x8d4}, 0x1, 0x0, 0x0, 0x8000}, 0x4)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r29 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r29, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

[ 1753.317493] binder_alloc: 13394: binder_alloc_buf, no vma
[ 1753.356647] binder: 13401:13402 transaction failed 29189/-3, size 0-0 line 3035
14:04:02 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1a0]})

[ 1753.364257] binder: 13401:13404 unknown command 1074029329
[ 1753.364276] binder: 13401:13404 ioctl c0306201 20000100 returned -22
[ 1753.368608] binder_alloc: 13394: binder_alloc_buf, no vma
14:04:02 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00]}, 0x2c)

[ 1753.420334] binder: 13394:13397 transaction failed 29189/-3, size 0-0 line 3035
[ 1753.428649] binder: release 13394:13395 transaction 476 out, still active
[ 1753.448326] binder_alloc: 13394: binder_alloc_buf, no vma
[ 1753.455211] binder: undelivered TRANSACTION_ERROR: 29189
[ 1753.468039] binder: 13401:13414 unknown command 1074029329
[ 1753.479798] binder: send failed reply for transaction 476, target dead
[ 1753.495985] binder: 13401:13404 transaction failed 29189/-3, size 0-0 line 3035
[ 1753.506268] binder: undelivered TRANSACTION_ERROR: 29189
14:04:02 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x5421, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:02 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00]}, 0x2c)

[ 1753.525447] binder: 13401:13414 ioctl c0306201 20000100 returned -22
[ 1753.579918] binder: undelivered TRANSACTION_ERROR: 29189
[ 1753.587662] binder_alloc: binder_alloc_mmap_handler: 13420 20005000-20009000 already mapped failed -16
[ 1753.609612] binder: BINDER_SET_CONTEXT_MGR already set
[ 1753.616277] binder: 13420:13423 ioctl 40046207 0 returned -16
14:04:02 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40046312}], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1753.636802] binder: release 13420:13421 transaction 481 out, still active
[ 1753.654305] binder_alloc: 13420: binder_alloc_buf, no vma
[ 1753.673568] binder: send failed reply for transaction 481, target dead
[ 1753.689750] binder: 13420:13426 transaction failed 29189/-3, size 0-0 line 3035
[ 1753.730424] binder: undelivered TRANSACTION_ERROR: 29189
[ 1753.737663] binder: 13431:13432 transaction failed 29189/-22, size 0-0 line 2896
[ 1753.761423] binder: 13431:13434 unknown command 1074029330
[ 1753.767071] binder: 13431:13434 ioctl c0306201 20000100 returned -22
[ 1753.810343] binder: undelivered TRANSACTION_ERROR: 29189
14:04:02 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x800000000000004, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:04:02 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}, 0x2c)

14:04:02 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c0]})

14:04:02 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x5450, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:02 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40086303}], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1753.975939] binder: 13443:13446 BC_FREE_BUFFER u0000000000000000 no match
[ 1753.987850] binder: BINDER_SET_CONTEXT_MGR already set
[ 1753.995869] binder_alloc: binder_alloc_mmap_handler: 13440 20005000-20009000 already mapped failed -16
[ 1754.006145] binder: 13440:13447 ioctl 40046207 0 returned -16
[ 1754.013002] binder: undelivered TRANSACTION_ERROR: 29189
[ 1754.061114] binder: release 13440:13442 transaction 488 out, still active
[ 1754.073287] binder: send failed reply for transaction 488, target dead
14:04:03 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800505af9b9aa1fcd028085b425120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000"], 0x50}}, 0x0)

14:04:03 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00]}, 0x2c)

14:04:03 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x4008630a}], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:03 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1d9]})

14:04:03 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0xa2c6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:04:03 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x5451, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:03 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1100]}, 0x2c)

[ 1754.350112] binder: BC_ATTEMPT_ACQUIRE not supported
[ 1754.361813] binder_alloc: binder_alloc_mmap_handler: 13463 20005000-20009000 already mapped failed -16
[ 1754.371777] binder: 13466:13470 ioctl c0306201 20000100 returned -22
[ 1754.380433] binder: BINDER_SET_CONTEXT_MGR already set
[ 1754.397749] binder: 13463:13471 ioctl 40046207 0 returned -16
14:04:03 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40086310}], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1754.439057] binder_alloc: 13463: binder_alloc_buf, no vma
[ 1754.452487] binder: send failed reply for transaction 493, target dead
14:04:03 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1200]}, 0x2c)

14:04:03 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
r0 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x3, 0x2)
ioctl$VIDIOC_DQEVENT(r0, 0x80885659, &(0x7f0000000200)={0x0, @motion_det})

14:04:03 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
r2 = syz_open_dev$vbi(&(0x7f00000000c0)='/dev/vbi#\x00', 0x3, 0x2)
ioctl$IOC_PR_CLEAR(r2, 0x401070cd, &(0x7f0000000080)={0x4})

14:04:03 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x277]})

14:04:03 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1300]}, 0x2c)

[ 1754.566353] binder_release_work: 2 callbacks suppressed
[ 1754.566359] binder: undelivered TRANSACTION_ERROR: 29189
[ 1754.566656] binder: 13484:13491 BC_DEAD_BINDER_DONE 0000000000000000 not found
14:04:03 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x5452, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:03 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x400c630e}], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:03 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1400]}, 0x2c)

[ 1754.666464] binder: undelivered TRANSACTION_ERROR: 29189
[ 1754.687836] binder_alloc: binder_alloc_mmap_handler: 13503 20005000-20009000 already mapped failed -16
14:04:03 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x4000)
r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0)='TIPC\x00')
sendmsg$TIPC_CMD_SET_LINK_TOL(r2, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000100)={&(0x7f00000001c0)={0x68, r3, 0x200, 0x70bd25, 0x25dfdbfb, {{}, 0x0, 0x4107, 0x0, {0x4c, 0x18, {0x81, @media='udp\x00'}}}, ["", "", "", "", ""]}, 0x68}}, 0x5aeb98cbb7f066e5)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

[ 1754.751488] binder: BINDER_SET_CONTEXT_MGR already set
[ 1754.782151] binder: 13503:13506 ioctl 40046207 0 returned -16
[ 1754.797728] binder_alloc: 13503: binder_alloc_buf, no vma
14:04:03 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1500]}, 0x2c)

14:04:03 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2ff]})

[ 1754.829950] binder_alloc: 13503: binder_alloc_buf, no vma
[ 1754.836959] binder: send failed reply for transaction 498 to 13503:13504
[ 1754.853791] binder_release_work: 4 callbacks suppressed
[ 1754.853797] binder: undelivered TRANSACTION_COMPLETE
[ 1754.860900] binder: 13513:13517 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1754.894074] binder: undelivered TRANSACTION_ERROR: 29189
[ 1754.909798] binder_alloc: 13503: binder_alloc_buf, no vma
[ 1754.922717] binder: undelivered TRANSACTION_ERROR: 29189
14:04:03 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x5460, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:04 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x2, 0x24000)
ioctl$VT_GETMODE(r1, 0x5601, &(0x7f0000000100))
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="021600000a000000a5055954e65795f6255c63472563e9b9000000e2ffffff070006000000effffffd8000000000ee0800000000000000aaff0700000000000000000000000000000000c3fbc6922009d290cd8c5a2f213d008af6b8f205b510efa2294ecbe73200000000000000000000000000006c1e99a00e0e070c479a9f7d37064a179088528e75cdd7ad2ed66a8619b97d2e838a8a7adec73077c02938602366914cfe4e204a4ef8a300000000"], 0x50}}, 0x0)

[ 1754.955687] binder: undelivered TRANSACTION_ERROR: 29189
[ 1755.048908] binder_alloc: binder_alloc_mmap_handler: 13529 20005000-20009000 already mapped failed -16
[ 1755.071243] binder: BINDER_SET_CONTEXT_MGR already set
[ 1755.077860] binder: 13529:13533 ioctl 40046207 0 returned -16
[ 1755.086938] binder_alloc: 13529: binder_alloc_buf, no vma
[ 1755.095123] binder: undelivered TRANSACTION_COMPLETE
[ 1755.137438] binder: undelivered TRANSACTION_ERROR: 29189
14:04:04 executing program 5:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fcntl$addseals(r0, 0x409, 0x4)
futex(&(0x7f0000000040), 0x3, 0x10000002, &(0x7f0000000000)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:04:04 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1800]}, 0x2c)

14:04:04 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x400c630f}], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:04 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x308]})

14:04:04 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x40046205, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:04 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0xc000, 0x0)
clock_gettime(0x0, &(0x7f0000000080)={<r3=>0x0, <r4=>0x0})
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r2, 0x402c5342, &(0x7f00000000c0)={0x3, 0x9, 0x9, {r3, r4+10000000}, 0x7, 0x3})
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="021600000a000000000000000000000008001200000000b100000000000000000040000000000000000000000000fe800000000000aafe80000004000000000000000000000000001c45048a087260e680dabe008aeca9c52c34a9c313b924cfea43a3e4e4d66b1dbd595a35962302eeef6c51330d4be49464b44a803250e099895a53ff3d8cbcb4096649ac2afb36eee73e1fb64ed1130cd061cde609be57794f2964f7028b44c2cb116418bd09a142dd1843ea069a0c816f66321e4cc791c8d648eecd6ee7c712f11285351081718a1a921844be58d2cc4cff91b12729e9fb2319a5220f8752c39c5947d9f56ec6a6f708ad2949650f01cb31926c4edbf74ff661ba9820b05aad8d53a1d57b819791e37edf2f032daa3681b07b0c3f257a870ea1ad0ea32af9a5b0b8d2c4d9ba9ad09fc8076e5086590090864587a14064028c18f63e6e1b5f4aa3cb027873f0cd749b645f2316c8dda9816c8a788987880000000000000000"], 0x50}}, 0x0)

[ 1755.441145] binder: 13547:13550 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
[ 1755.458533] binder_alloc: binder_alloc_mmap_handler: 13543 20005000-20009000 already mapped failed -16
[ 1755.479740] binder: BINDER_SET_CONTEXT_MGR already set
14:04:04 executing program 5:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
r1 = dup3(r0, r0, 0x80000)
ioctl$KVM_GET_REGS(r1, 0x8090ae81, &(0x7f0000000000))
openat$cgroup_ro(r1, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x0, 0x0)

14:04:04 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00]}, 0x2c)

[ 1755.492967] binder: 13543:13553 ioctl 40046207 0 returned -16
[ 1755.506887] binder_alloc: 13543: binder_alloc_buf, no vma
14:04:04 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}, 0x2c)

[ 1755.551773] binder: send failed reply for transaction 506 to 13543:13545
[ 1755.558785] binder: send failed reply for transaction 507 to 13547:13550
[ 1755.558805] binder_transaction: 13 callbacks suppressed
[ 1755.558821] binder: 13543:13557 transaction failed 29189/-3, size 0-0 line 3035
[ 1755.595586] binder: undelivered TRANSACTION_COMPLETE
14:04:04 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000000800000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

[ 1755.600976] binder: 13547:13550 transaction failed 29189/-22, size 0-0 line 2896
[ 1755.601047] binder: 13547:13564 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
[ 1755.629844] binder: undelivered TRANSACTION_ERROR: 29189
14:04:04 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000]}, 0x2c)

[ 1755.650924] binder: undelivered TRANSACTION_ERROR: 29189
14:04:04 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x40046207, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:04 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
eventfd(0x4)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000140)='/dev/cachefiles\x00', 0x20200, 0x0)
write$P9_RREMOVE(r0, &(0x7f0000000200)={0x7, 0x7b, 0x2}, 0x7)
futex(&(0x7f0000000000)=0x2, 0x0, 0x1, &(0x7f0000000040)={0x0, 0x989680}, &(0x7f0000000100)=0x1, 0x1)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
pipe(&(0x7f0000000080))
r1 = gettid()
get_robust_list(r1, &(0x7f0000000340)=&(0x7f0000000300)={&(0x7f0000000280)={&(0x7f0000000240)}, 0x0, &(0x7f00000002c0)}, &(0x7f0000000380)=0x18)

14:04:04 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40106308}], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1755.719551] binder: undelivered TRANSACTION_ERROR: 29189
14:04:04 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x47f]})

14:04:04 executing program 3:
r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x0, 0x0)
getpeername$packet(0xffffffffffffff9c, &(0x7f0000000080)={0x11, 0x0, <r1=>0x0}, &(0x7f00000000c0)=0x14)
setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f0000000100)={r1, 0x1, 0x6, @link_local}, 0x10)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r2, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r3 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:04:04 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff]}, 0x2c)

[ 1755.802151] binder: BINDER_SET_CONTEXT_MGR already set
[ 1755.856498] binder: 13577:13579 ioctl 40046207 20000100 returned -16
[ 1755.857042] binder: 13581:13582 BC_INCREFS_DONE u0000000000000000 no match
[ 1755.885970] binder_alloc: binder_alloc_mmap_handler: 13577 20005000-20009000 already mapped failed -16
[ 1755.933104] binder: BINDER_SET_CONTEXT_MGR already set
[ 1755.938575] binder: 13577:13592 ioctl 40046207 0 returned -16
[ 1755.945538] binder: 13577:13596 transaction failed 29189/-3, size 0-0 line 3035
[ 1755.945763] binder: BINDER_SET_CONTEXT_MGR already set
14:04:05 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}, 0x2c)

14:04:05 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/mixer\x00', 0x10000, 0x0)
ioctl$DRM_IOCTL_CONTROL(r1, 0x40086414, &(0x7f0000000100)={0x2, 0x2})
r2 = socket$key(0xf, 0x3, 0x2)
r3 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2)
ioctl$EVIOCSCLOCKID(r3, 0x400445a0, &(0x7f0000000080)=0x4)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

[ 1755.981148] binder: 13577:13597 ioctl 40046207 20000100 returned -16
14:04:05 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x480]})

14:04:05 executing program 5:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6291, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0x80, 0x0, 0x0, 0x0, 0x0)
ioctl$PERF_EVENT_IOC_REFRESH(r0, 0x2402, 0x8)

[ 1756.008136] binder_thread_release: 2 callbacks suppressed
[ 1756.008146] binder: release 13577:13579 transaction 511 out, still active
[ 1756.049801] binder: undelivered TRANSACTION_COMPLETE
[ 1756.061012] binder: undelivered TRANSACTION_ERROR: 29189
[ 1756.084058] binder: send failed reply for transaction 512 to 13581:13582
14:04:05 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x2c)

[ 1756.094525] binder: 13581:13582 transaction failed 29189/-22, size 0-0 line 2896
[ 1756.094534] binder: 13581:13607 BC_INCREFS_DONE u0000000000000000 no match
14:04:05 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:05 executing program 3:
socket$inet_udplite(0x2, 0x2, 0x88)
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:04:05 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}, 0x2c)

14:04:05 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40106309}], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:05 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x491]})

[ 1756.244935] binder: release 13618:13619 transaction 516 out, still active
[ 1756.309667] binder: undelivered TRANSACTION_COMPLETE
14:04:05 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000]}, 0x2c)

[ 1756.338828] binder: 13630:13633 BC_ACQUIRE_DONE u0000000000000000 no match
[ 1756.361934] binder: BINDER_SET_CONTEXT_MGR already set
14:04:05 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x290400)
ioctl$SG_GET_KEEP_ORPHAN(r1, 0x2288, &(0x7f00000001c0))
ioctl$KVM_TRANSLATE(r1, 0xc018ae85, &(0x7f0000000080)={0x3000, 0x4000, 0x6434, 0x8, 0x10000})
ioctl(r0, 0x10000005, &(0x7f0000000040)="0adc1f123c123f3188b070")
ioctl$TIOCGSOFTCAR(r1, 0x5419, &(0x7f0000000100))
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="0200000000000008001200000000000000d5ca56d1000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000000000000000000000"], 0x50}}, 0x0)
getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, &(0x7f00000002c0)={<r3=>0x0, @in={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x18}}}, [0x401, 0x9, 0x513bd8a1, 0x100, 0x4, 0x1, 0x9, 0x9, 0x101, 0x7ec9, 0xffffffffffffff80, 0x0, 0x81, 0x7fffffff]}, &(0x7f0000000200)=0x100)
getsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f00000003c0)={0x2, 0x4, 0x617, 0x9, r3}, &(0x7f0000000400)=0x10)
setsockopt$inet_sctp_SCTP_INITMSG(r1, 0x84, 0x2, &(0x7f00000000c0)={0x0, 0x80000001, 0x8000, 0x4}, 0x8)

[ 1756.387890] binder_alloc: binder_alloc_mmap_handler: 13618 20005000-20009000 already mapped failed -16
[ 1756.406732] binder: 13618:13631 ioctl 40046207 0 returned -16
14:04:05 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000]}, 0x2c)

14:04:05 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d0]})

[ 1756.438902] binder: 13618:13619 transaction failed 29189/-3, size 0-0 line 3035
[ 1756.477048] binder_send_failed_reply: 2 callbacks suppressed
14:04:05 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000]}, 0x2c)

[ 1756.477055] binder: send failed reply for transaction 516, target dead
[ 1756.504535] binder: send failed reply for transaction 517 to 13630:13633
[ 1756.519145] binder: 13630:13646 BC_ACQUIRE_DONE u0000000000000000 no match
[ 1756.533127] binder: 13630:13633 transaction failed 29189/-22, size 0-0 line 2896
14:04:05 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000084, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:04:05 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="021600000a000000000000000000000006000040000000000000000000000000fe8007000000000000000000000000aafe80000000000000004e7ded00000000000000000000000000000000000000000000001a4da72d51bc5383bd6bbf5456691158c7c338deeffacf4304d00fcc0c2f9f908f92d8f510671a9bc9a004"], 0x50}}, 0x0)
r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vsock\x00', 0x200000, 0x0)
ioctl$TIOCGPGRP(r2, 0x540f, &(0x7f00000001c0)=<r3=>0x0)
ptrace$pokeuser(0x6, r3, 0x7, 0x7a)
ioctl$VIDIOC_QUERYMENU(r2, 0xc02c5625, &(0x7f0000000100)={0x401, 0x0, @name="765af0576e734a6a74d269e33be6712cbf2d744538bd4f4b02ac5ee57704852f"})

14:04:05 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x40049409, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:05 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000]}, 0x2c)

14:04:05 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40406300}], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:05 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x560]})

14:04:06 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000]}, 0x2c)

[ 1757.003233] binder: 13662:13663 transaction failed 29189/-22, size 0-0 line 2896
[ 1757.036600] binder: BINDER_SET_CONTEXT_MGR already set
[ 1757.066788] binder: release 13662:13674 transaction 523 out, still active
[ 1757.076496] binder_alloc: binder_alloc_mmap_handler: 13666 20005000-20009000 already mapped failed -16
[ 1757.079877] binder: 13666:13672 ioctl 40046207 0 returned -16
[ 1757.101746] binder: undelivered TRANSACTION_COMPLETE
14:04:06 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:06 executing program 5:
r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='pids.events\x00', 0x0, 0x0)
getsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f0000000100), &(0x7f0000000140)=0x4)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
r1 = syz_open_dev$vbi(&(0x7f00000002c0)='/dev/vbi#\x00', 0x0, 0x2)
write$P9_RLINK(r1, &(0x7f0000000040)={0x1, 0x47, 0x1}, 0x1)
ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000000200)=""/170)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:04:06 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)
r2 = syz_open_dev$sndpcmc(&(0x7f0000000000)='/dev/snd/pcmC#D#c\x00', 0x740c1b36, 0x4000)
ioctl$PIO_UNIMAPCLR(r2, 0x4b68, &(0x7f0000000080)={0x7, 0x4000000000000000, 0x7})

[ 1757.121057] binder: release 13662:13675 transaction 524 out, still active
[ 1757.142442] binder: release 13666:13667 transaction 522 out, still active
[ 1757.155584] binder: 13666:13667 transaction failed 29189/-3, size 0-0 line 3035
[ 1757.164242] binder: undelivered TRANSACTION_COMPLETE
14:04:06 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9000000]}, 0x2c)

14:04:06 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x561]})

[ 1757.197167] binder: send failed reply for transaction 522, target dead
[ 1757.207765] binder: send failed reply for transaction 523, target dead
[ 1757.219114] binder: 13679:13685 transaction failed 29189/-22, size 0-0 line 2896
[ 1757.240349] binder: send failed reply for transaction 524, target dead
14:04:06 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000]}, 0x2c)

[ 1757.295723] binder: 13679:13680 transaction failed 29189/-22, size 0-0 line 2896
14:04:06 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x4020940d, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:06 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x3b9}}, 0x0)

[ 1757.349942] binder: 13679:13685 got reply transaction with no transaction stack
14:04:06 executing program 5:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
r1 = add_key$keyring(&(0x7f0000000000)='keyring\x00', &(0x7f0000000040)={'syz', 0x0}, 0x0, 0x0, 0x0)
keyctl$get_keyring_id(0x0, r1, 0x9)
ioctl$int_in(r0, 0x5473, &(0x7f0000000080)=0x7)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:04:06 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40486311}], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:06 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x570]})

[ 1757.563445] binder: BINDER_SET_CONTEXT_MGR already set
[ 1757.568894] binder: 13704:13712 ioctl 40046207 0 returned -16
14:04:06 executing program 5:
fcntl$getownex(0xffffffffffffff9c, 0x10, &(0x7f0000000000)={0x0, <r0=>0x0})
r1 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc4001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x0, 0x0, 0x0, 0x0, 0x1000000000}, r0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffe)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x0, &(0x7f0000000040), 0x0, 0x0)
r2 = socket$nl_crypto(0x10, 0x3, 0x15)
ioctl$sock_proto_private(r2, 0x89ee, &(0x7f0000000200)="1fcc77c7ffdc92a8cf54f1c5841e0c36edac0d754b7cb5ec32996bf1815a3e17ec6445d89d62d79f75eb2f406b559fe2a8c43768af4bcb18c4913911140b20375307bb44a5d4b9f988c3ab2008bdfe3e70415f3ab7e3df2527dfc8fc9dbf5be926f5a41dda05ce364f58a1dc6f6941b135d9f6766908b3ebddb731604edc0f2cab712de7a16f8509b814153375f251265d74679ea871e30ee6596eee96828c51db0ee9ffc137d45655d10f6e5f4d7d3665e287bd2cfa15624e0ca8479de43f9cc37d8ef26fd8417a935cba2d4c58e2a7720a86ed4881c2841fe88939936f8d5af369e884442c90df06fe4dea7fbc472f077b177be8b1f07b0ff3267957c97f65fc6fa5839087ef2fc8710bc1ae3233049b530c3d744a169913b3b3888d9f30f7c75b00f51f95dc58f3c0203ab072500e97a7a9d0321cf703d02867824250ba6042901f2849876c92202c96558bdd7f1dfde6167b6726308ec1298b1345b5f90c0d97fc08142d3a66b302bf86412849f0c81c423988d10e69ad55037cbe92cf38bf06b1a385de15ba1363cbe7c41965aecc2e1e3381d75e685664d5de346892838f26b8c4d19bbb662f736dd4a3791c4af9528bf8445a6ae66a98b7d8ca20d126b57b3ce5f039d2a1f274666efa74834bde66ae7c08240a85ca2de885b81f6ea75ed5f8f5100d208ed547055f45cfc5a0af26e9edb3c7103424b1aad34b324aa87dd746bf2f87de1c1c4fa290ff6c470d34624ccd9574f6e8e734747921a831a8130469044904f6c4e464816e4be8cb6c6eb829e073d3604a082b74bcbcb29b6e66388cf2f6ead107dcd4592d2758df530362dff36fcd5c160c0579381f023b9fe974ae1657f9cfffe3b3ee0f3152ebe7b91a0c4784c91a6c001ff341e17f3f36540ef5df9b60718355dc956ed15e7578fcf76f61ef50f7d94c4d74dff3e551b9b68773c3073ad1e72c0184dd9b32a703c4ee616fa7b1c1e345f8700b94fe63423f9d7065fe1391b93f0b7426410cd20600abf2a5eda424b05823d4b54b09a02ebd0c4e4feb8e2dc299e0615e770a46cc1bc674a067f31c07e844369ce2d221a0af9825ab24881d660633200a21c868b08a049473ba44e92d29c5963f743f080a8bc354bba6d6ef8a44a261c1d10450a3b399f2b1850b8816ac6d9d15ddd943bfd6573d6e0d03b267495615f37904e2a2e97eb474a3e766e1fb024eb1f7a7bddbc2a9e56f7b5ffc248718c7286b5207d7f3f6b223606e93e2b3963b7caf6249b342b9102cdc60210d2c2059a4b3328ed7ddfede27fc926341acbc5fd8be8bbeb8081c1fb8e85ce31806e2a200bc73024fa0cc02dbea37c89210b715ca92953fb49ac0f7759de21774e6057fb133ddef2b5f81d7f8360c7c3e0f428833b91144910db24f7784025e3813230b99cfb1b86c5ddb40d0274af684276ebf95c60a8dd6f2d48a453c235a4b7b5518d915ff1c1af33a9069058f6e87febd0ceb2af2ef1d2bc7ea84ac8de6dca18f3490b4f88be771393f5de0b15bbab82d271ae13fabae79ac8e02bfa69a5e5eb1cde3e5a27af3e5bf45f0351e38d718f4296025c4ac5f79303ee3fb810383309e924d1d3fb4f23d0f777ae47247e359fc91e8d09cfb1adc5cfafb2757327747350487647acfb86b6c9a83003dab2a38a0dd16564fa1f41069f0d512ce9a3f1606ea87309edec21ae80f8f854572ef1d7f1bc203f813ecc34ee35ad4ba37ac46ffc6471d7e7cf8cfa7087b3eb74e1793da4660317313443954617259a790d21ba5b159922e8941897c143fc87bdcaa858803ff7e206b6ef3d09f470af8312286ac4b5ac86d0d52c5534332f6fd06a044eb61acd878425bb863a08e7c9648ad9373e34ef8fdf9efc91d6cd828d13d3e0075457f9a542648f3c0892beb0d73f59b198b9e25270cc774ed4df5f5dbad82a2944eb0b50743298b0a6a697853843e0b39fe4a288e7437640ea4f828e5af2c48c7dd078d264a40b592cb1d51d4fd8c85bbbd63ed2140aeb4ce0e8007b06edee5e54be261a83aa510a8daa787b3a4f5804d94561a39f18b72c4dd94bc79af954264b7e22eee7aa16c00578bef816afa08e4a786150bd006e2767244c9689dea42827b75a96731bfb2dfd4e5dc60c57b38ed7ef993bf4af142187c5e05bce93c8f7b7d70e550e6925da935fc9cac94e38d2889bf7281700b3bf6ac8a7fd38b42da9b76def00722a713bcc8e1150e71eca5c39c948ac8a4a1dd905cd79bf9d558f01ba79d603d8e06a11995f1da870950620b0f143152c183243390b075e2929b645aaf51a9b3fefe9bff338918502728d8bb6e63afd12236641c7470f8e7da83fc1724293d18aba0fe4f9350850ec150bc7d5791ff180dbb79f5f0abcead8eb5b9add59fa398cfba5b42d0cd26a10fcc90b2c83085db9b1f65559910c6bf8abde9a9aeba1bc6996bbbb0a8d915c0fcdf33d5b2d522e3e0b8b0e37b3cfd3665c3f799cd78231025ac63dd729a9bfbdfe41f470adff079209d2c4c62d422878afd1c1503d44834b45a5a33ed8f2ca0fc00437a02ae0fc413017a6d39ba420e9cb162a8ea8db8856e335a1e518044b77fd141a0e3945c6d00f14f1c380799632605c6eb23ce089e0cddf63f02b57f2bccf1fda27539cbea7e1883b5595e6db7318fd9650b8e359cc0b554c47b9aa8a7051847b0b577bfb606c351df322a861ff06b13396846dcf12ddb9a04abf00641956ef6df661c26360775be6b27bc22c34dc1c602fdf2e62661017c0220dbb942a229cf444cfbc7af6044a7a838c6a8d423b261de637d38c805272ad0bf12634afe95f6e7f3d7488ffdfe7a60a9d0bfc5ed44a711dd40fc6c23964a7c00cc11fac2ea7eb5fcba9963bfda7a715d794a09dac4c96b296b882b1e314607f4e987c67c0a4bb06c1d0e3abf271e38c7a908db353e64fb5c309c89657f01d2f8283cad09a4960a2f0098888c51aacc621ae9e1a2c253bc168cfb8e2db3d0230114685edf5ff244e5b78e528f4ff6729d087269675b6c7b135b8ab17cdcc1b8b2f50a019abeb762247e10a5a8fbab004ffb6e33e9dfb3bd8ea57fe15e19801ac04739f80b952eb0cef20e80930a6bf6dc46eadc99868a9d7dc659b53da98f535c02432c13afcdd5162e44a8a985340cb395be4bdd06837f96f5aec5adfb43db315116d0fdfb6dcf42124f5aff69449e41b8f93ecdfaad1a1030eff430fc4d0db12edf8015aac1ffa3dc580a279c8b3a28ce799fb07c9754549f53691e1a1d4a3e841a5ad66a77929cae46234a8486df17baa9128365b4fa6b87e4a7a67bd7c712dd6904bb691417d07e137c4116627d0ff55ea170003d64835311be34ef2e1c67fe15c8c6c2095d9c07061b2b59ff33f7239bf25bfb74f6192eec42ade983e302c9a86f69abd56e29221f9db2f749fa73f503a7b3fd67a2f0dc047ed9021afd8194b2ed042a809652eb1380d2ad36b82259ab60fed281527fd6901b5e89496eab5b71b6cd972900d748b0d8cdc15ee8b2c9b974bced14d9634ccb055dfe4ab0a75b3dc36424b639f755abb589ffdb7505b870063b1135d6161e047c35996eef8f48fa8facc4da13373767f76aee6774c9d3f12d42dbacbff18a03ba0ba39fab16e2101cc980c1e3501b4eb3adc5c35511e7593d0c3749da10d4774b4b745546f17b05a7a7794da8d1b417e2a520db8198d1a25749627bf157cdea36128b93634920f0218cefb53a1f1db7d198ae608c95b108ef8d902d32c82432254c7260f41c7fea18fda7ace0142769ab69cb224a8d0ba4deaecea6329ec5ab851cb4ca4122b0a20d4b4a0897a3886590cf83cf7d176a7554af57e796234d7a4033a3d037cc8ab78abff116660a0d28206b54fce6761ec4d91239123c5b61fa2db48e7911ddbdcb54337350395773f1730109fe99ab158f26a217e245de76360acf09199bbd3eb07c9c6ac203c9259f9786a0904a3679249316376157da91eca5a0f942c4760c0005dc10b0c2ed3632ac4040b05241d42dee224dff57d8ffe0fcaff1a0f4a727b756397a068bed5f2e76b58f1396ffebb9d2a255945dd8c1a847def22e8caf7752b7010b611fceb0d712d39ec6bb31c3c0a19e234409d97386d5ecb5f99f10b00cde5a0423c9e10f487da9d35178afc6916d7db2a11867f9ce0f2741933428f7106048c2e577b0b242ec9c7f31da368151130d88ae8beab4479980fea0367c2d333c16b8b5839e2969a69933d6c85b687d138533e73095f64fd609ee38feb01f8d2e85e7a83c5e7bfeac25fd89ed06e1647e529b1640165cf1cb751c067f2d5e03935122ae3430f1f709b705c13cf5689eae4e1ebd41d95a40fd20d00f3ca6a830f22a3f37389f8b69b966fee1f58d2f81bcf3f0e9130fb83b90aa8af057ae7e979112d986f6ad84b469fb8a67a6ac182ef3676e501ca9f2db6410237ea2def97b66967c69cc9540b812364666f760a1a49493adca53a9d16ae3b6734adc9d42df89215f0794252827349aaf0b0a866aed1815a3df339d585b93f2ff1a43f3b56e39e7cb5a73cc7fdb733003c22b05cb4e59c2c3b33d449be955782fe27bfa27a3de03c3c3cea8a185e048e18a36e8841dc0cc43eb7da8d14fb618fa28f24745807aba3214fb57fea2b9a12b39c50954fe3bfc2b1947010a001a61ef3eac9da8eeafc85a32b9c97bedc14e45991eeaa3b2b2eb38b9d281aa322bac883d8ec6acf25da06585c74e027aab521db7865a6a82432b3d7b939a99b81e48e010bfb25884b530432a4187002b3c99a9239b6c3da539a9f41e656de48e8373152624e55d94cb5e2a72194148896205a06eb51c028c919df8d4435d81e5580c790adc0460a781a54370b889dc7eaa2366c58bb1cb3002d721b7e0930624d6253ba3b3323ec027931c2ecd92cccf10220595192fad88108e7c29323474c6ba665e8f72a257834f6524e381ed1caebdf33feb143ebac8410147cd9c412f76719641809be6f46277c5f00dcc8df04ef8896973d8b9d8b3fe2d5b4a7cf4260ec9fa356061bc1ab546fde1a3caf944f79d9a92c9752defbcfc3877e51d6e11146dbfef7b154b1ddfc96ba1bc58fceb51cb5f825098f643bf789187951abd9ed884998a1c67a5e899072ad479da0f9846dd1bd1cd16a016d7d6514784409d78cba1589f2951f96fd1f75c58294f5665ed468834511b8c830ce3e91b6b4c738246aa3314dd145d4df5b7d1d53173cfc73a4c57ee6e980c861c9a728e577f71c46c293513be740a485d43db5d176464486f20618ce250cb60312895e339d8bf6e31e033a1a77413ab131f8df848be73ed87fd01cc56f01447ec16fc30778c5258ff65303d1c88571e44eaa109dcf2c568631120a24c0705d40d781ba523aa25e88440f7a4ad678d27119bc987ce16fbd0993eccbd60652c0a73780ab11ee766e3996fcc7c0dc49cd0cdbfbffb458ebef4f15c4f4a25649a69ddac0d571e64294ba169c6887598de77be7aaaa583ec195f577ab0d35026bca4239533441b7be410b3a7cd5a7d6bbf8fc59f3183014ebb8b3a1ae6f2be13f4ac22bd30152aaafa88909acec5c218c87fe1ac486ee2b94eee2e99c7ea9b377fe09021f54c69cb0d87e5822c67ad20f1913b4dde9cd0df809d0105d258af2ab2b0820738fac28548f3cbe23687b0c7ae602b8f5207fd7b2049d13680a156c377a03cb117613ca53f594594760ca95a50bbc8915a6de80169d00222cbf6c9cd5488201b0b58e970f8ea3f884dc4557e45c6fba0944972b677f5f8a7468dbedd141537a017f2b9038bc18b009d5c")
ioctl$EXT4_IOC_ALLOC_DA_BLKS(r1, 0x660c)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x226)

14:04:06 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40486312}], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1757.631108] binder: release 13704:13706 transaction 530 out, still active
[ 1757.640264] binder: undelivered TRANSACTION_COMPLETE
[ 1757.650213] binder: send failed reply for transaction 530, target dead
14:04:06 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
getsockopt$IP_VS_SO_GET_INFO(r0, 0x0, 0x481, &(0x7f0000000000), &(0x7f0000000080)=0xc)
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000cefe800000000000000000000000000000"], 0x26b}}, 0x0)

14:04:06 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb000000]}, 0x2c)

[ 1757.749057] binder: 13724:13730 got reply transaction with no transaction stack
14:04:06 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc000000]}, 0x2c)

14:04:06 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:06 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x571]})

14:04:06 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x400000, 0x0)
ioctl$SNDRV_SEQ_IOCTL_GET_NAMED_QUEUE(r0, 0xc08c5336, &(0x7f0000000200)={0x0, 0x101, 0x0, 'queue1\x00', 0x6})
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:04:06 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40046305, 0x3f00}], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:06 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r1 = socket$key(0xf, 0x3, 0x2)
r2 = dup3(r0, r0, 0x80000)
ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r2, 0x40505330, &(0x7f0000000080)={{0xffffffff, 0xffffffffffffffe1}, {0xfffffffffffff0eb, 0x2}, 0x11e, 0x0, 0x7})
sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

14:04:07 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd000000]}, 0x2c)

14:04:07 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
r0 = socket(0xa, 0x3, 0x177)
getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(0xffffffffffffffff, 0x84, 0x1b, &(0x7f0000000200)={<r1=>0x0, 0xd0, "f8fa0a62080931d4758e5eec6d27964b54f01d1f5eb95b88f77234de889f572772c823e351411f18e7baf56e26786454650054fa7e4e36c8678c9463dc6e574b3e59a5fbaaa99a83a7df5f614919ea3639541788a33d4bba4315abbe5471fd67f3044b5db6b4106c570d8749d50b6c7aa59d82e4a4b6e06d563a1fb2ec59c5d5fa3736896ad416b2cbfc7922bc4eb8680ba0152f1521df77ee9184cd213225a8d52c48ed01d1882834c59860b12df013bf8ccdf34c434aa8c65709147a8564027ad0caca40e86ac34fb3d8e37f5eef21"}, &(0x7f0000000000)=0xd8)
getsockopt$inet_sctp_SCTP_MAXSEG(r0, 0x84, 0xd, &(0x7f0000000040)=@assoc_value={r1, 0x2}, &(0x7f0000000080)=0x8)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

[ 1757.982501] binder: 13752:13758 Acquire 1 refcount change on invalid ref 16128 ret -22
[ 1757.986509] binder: BINDER_SET_CONTEXT_MGR already set
[ 1758.031474] binder: 13742:13755 ioctl 40046207 0 returned -16
[ 1758.031989] binder: release 13742:13750 transaction 539 out, still active
[ 1758.078517] binder: undelivered TRANSACTION_COMPLETE
14:04:07 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40046305, 0x1000000}], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:07 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}, 0x2c)

[ 1758.102967] binder: send failed reply for transaction 539, target dead
14:04:07 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x572]})

14:04:07 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0045878, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:07 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x8, 0x400002)
sendmsg$key(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x2, 0x4, 0x9, 0x9, 0x10, 0x0, 0x70bd2c, 0x25dfdbfd, [@sadb_x_kmaddress={0x8, 0x19, 0x0, @in6={0xa, 0x4e20, 0x5, @dev={0xfe, 0x80, [], 0xa}, 0x6ce8}, @in6={0xa, 0x4e22, 0x400, @mcast2, 0xfffffffffffffffc}}, @sadb_ident={0x2, 0xb, 0x2, 0x0, 0x1}, @sadb_sa={0x2, 0x1, 0x4d4, 0x1, 0x4, 0xbe, 0x3}, @sadb_spirange={0x2, 0x10, 0x4d5, 0x4d6}]}, 0x80}}, 0x8001)
ioctl(r0, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070")
r2 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="021600000a00000000000000000000000800120000000000000000000000000006000040000000000000000000000000fe8000000000000000000000000000aafe800000000000000000000000000000"], 0x50}}, 0x0)

[ 1758.153994] binder: 13770:13772 Acquire 1 refcount change on invalid ref 16777216 ret -22
14:04:07 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
keyctl$set_reqkey_keyring(0xe, 0x4)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:04:07 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40046305, 0x3f000000}], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1758.267453] binder_alloc_mmap_handler: 2 callbacks suppressed
[ 1758.267470] binder_alloc: binder_alloc_mmap_handler: 13778 20005000-20009000 already mapped failed -16
14:04:07 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf000000]}, 0x2c)

[ 1758.343538] binder: BINDER_SET_CONTEXT_MGR already set
[ 1758.369745] binder: 13778:13786 ioctl 40046207 0 returned -16
[ 1758.370014] binder_alloc_new_buf_locked: 10 callbacks suppressed
[ 1758.370022] binder_alloc: 13778: binder_alloc_buf, no vma
[ 1758.392366] binder: release 13778:13782 transaction 546 out, still active
[ 1758.403501] binder: undelivered TRANSACTION_COMPLETE
14:04:07 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x580]})

14:04:07 executing program 5:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x4, 0x401, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000100)={<r1=>0xffffffffffffffff, r0, 0x0, 0x2, &(0x7f0000000080)=')\x00', 0xffffffffffffffff}, 0x30)
r2 = getpgid(0x0)
setpgid(r1, r2)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x7f, 0x101000)
r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/protocols\x00')
fcntl$getflags(r3, 0x3)
ioctl$KVM_DIRTY_TLB(r3, 0x4010aeaa, &(0x7f0000000040)={0x101, 0x2})

14:04:07 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000]}, 0x2c)

14:04:07 executing program 3:

[ 1758.421267] binder: send failed reply for transaction 546, target dead
[ 1758.437900] binder: 13792:13800 Acquire 1 refcount change on invalid ref 1056964608 ret -22
[ 1758.454883] binder_alloc: 13778: binder_alloc_buf, no vma
14:04:07 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0046209, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1758.520063] binder: 13792:13800 Acquire 1 refcount change on invalid ref 1056964608 ret -22
14:04:07 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11000000]}, 0x2c)

14:04:07 executing program 3:
mkdir(&(0x7f0000000380)='./file0\x00', 0x0)
mount(0x0, &(0x7f000000aff8)='./file0\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0)
chdir(&(0x7f0000000480)='./file0\x00')
setxattr$security_capability(&(0x7f0000000100)='./bus\x00', &(0x7f0000000180)='security.capability\x00', &(0x7f00000001c0)=@v2, 0x14, 0x0)
creat(&(0x7f00000000c0)='./bus\x00', 0x0)

14:04:07 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40046305, 0xfdfdffff}], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:07 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = creat(&(0x7f0000000000)='./file0\x00', 0x2)
r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000080)='/dev/mixer\x00', 0x40000, 0x0)
linkat(r0, &(0x7f0000000040)='./file0\x00', r1, &(0x7f0000000100)='./file0\x00', 0x400)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000200)=0x14)
bind$xdp(r0, &(0x7f0000000240)={0x2c, 0x4, r2, 0x19, r0}, 0x10)

14:04:07 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x587]})

[ 1758.634220] binder_alloc: binder_alloc_mmap_handler: 13814 20005000-20009000 already mapped failed -16
[ 1758.725537] binder: BINDER_SET_CONTEXT_MGR already set
14:04:07 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12000000]}, 0x2c)

[ 1758.751263] binder: 13814:13817 ioctl 40046207 0 returned -16
[ 1758.759864] binder_alloc: 13814: binder_alloc_buf, no vma
[ 1758.777236] binder_alloc: 13814: binder_alloc_buf, no vma
[ 1758.792168] binder: release 13814:13815 transaction 551 out, still active
14:04:07 executing program 3:
r0 = open(&(0x7f0000103ff8)='./file0\x00', 0x141042, 0x0)
ftruncate(r0, 0xbd20)
r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ptmx\x00', 0x802, 0x0)
sendfile(r1, r0, 0x0, 0x40800fff)

[ 1758.803011] binder: send failed reply for transaction 551, target dead
[ 1758.818539] binder: 13829:13833 Acquire 1 refcount change on invalid ref -33685505 ret -22
14:04:07 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6e0]})

14:04:07 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x0)

[ 1758.870004] binder_alloc: 13814: binder_alloc_buf, no vma
14:04:07 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13000000]}, 0x2c)

14:04:07 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40046305, 0xfffffdfd}], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:08 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc018620b, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:08 executing program 3:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
syz_emit_ethernet(0x4a, &(0x7f0000000080)={@local, @random="447394ed2abd", [], {@ipv6={0x86dd, {0x0, 0x6, "d8652b", 0x14, 0x2c, 0x0, @local={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x140]}, @local, {[], @tcp={{0x0, 0x9, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0)

14:04:08 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14000000]}, 0x2c)

14:04:08 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x803]})

[ 1759.060960] binder: 13854:13861 Acquire 1 refcount change on invalid ref -515 ret -22
[ 1759.071700] binder_alloc: binder_alloc_mmap_handler: 13858 20005000-20009000 already mapped failed -16
[ 1759.081690] binder_alloc: 13858: binder_alloc_buf, no vma
14:04:08 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x15000000]}, 0x2c)

14:04:08 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40046305, 0x100000000000000}], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1759.146003] binder: BINDER_SET_CONTEXT_MGR already set
[ 1759.164222] binder: 13858:13864 ioctl 40046207 0 returned -16
14:04:08 executing program 3:
r0 = syz_open_procfs(0x0, &(0x7f0000000040)='cmdline\x00')
pread64(0xffffffffffffffff, 0x0, 0xfc, 0x0)
close(r0)
write$P9_RFSYNC(0xffffffffffffffff, 0x0, 0x0)
fcntl$getownex(0xffffffffffffffff, 0x10, 0x0)
getpgrp(0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280))
getpgid(0xffffffffffffffff)
getpeername$netlink(r0, 0x0, &(0x7f0000000080))
getresuid(0x0, 0x0, 0x0)
shmctl$IPC_SET(0x0, 0x1, 0x0)

14:04:08 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18000000]}, 0x2c)

[ 1759.223451] binder_alloc: 13858: binder_alloc_buf, no vma
[ 1759.240821] binder: send failed reply for transaction 557 to 13858:13859
14:04:08 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa01]})

[ 1759.303722] binder: 13879:13884 Acquire 1 refcount change on invalid ref 0 ret -22
14:04:08 executing program 5:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
accept(r0, &(0x7f0000000000)=@x25={0x9, @remote}, &(0x7f0000000080)=0x80)
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)

14:04:08 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc018620c, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:08 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f000000]}, 0x2c)

14:04:08 executing program 3:
socketpair$unix(0x1, 0x4000000000002, 0x0, &(0x7f0000000480)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r0, &(0x7f0000001080)=[{{&(0x7f0000000ac0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @remote}}}, 0x80, 0x0}}], 0x1, 0x0, 0x0)

14:04:08 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40046305, 0x3f00000000000000}], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:08 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xbff]})

[ 1759.790968] binder: 13898 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero.
[ 1759.790980] binder: 13898:13901 ioctl c018620c 20000100 returned -22
14:04:08 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe4ffffff]}, 0x2c)

[ 1759.834303] binder_alloc: binder_alloc_mmap_handler: 13898 20005000-20009000 already mapped failed -16
[ 1759.841660] binder: BINDER_SET_CONTEXT_MGR already set
[ 1759.866883] binder: 13898:13912 ioctl 40046207 0 returned -16
[ 1759.878932] binder_alloc: 13898: binder_alloc_buf, no vma
14:04:08 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000]}, 0x2c)

[ 1759.902014] binder: 13898 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero.
[ 1759.902026] binder: 13898:13912 ioctl c018620c 20000100 returned -22
[ 1759.934282] binder: release 13898:13901 transaction 563 out, still active
14:04:08 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd90]})

14:04:09 executing program 5:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0xa, 0xfffffffffffffffc, 0x0, 0x0, 0x223)
r1 = fcntl$dupfd(r0, 0x406, r0)
openat$md(0xffffffffffffff9c, &(0x7f0000000040)='/dev/md0\x00', 0x0, 0x0)
ioctl$BLKFLSBUF(r1, 0x1261, &(0x7f0000000000)=0x1)

[ 1759.948247] binder_release_work: 2 callbacks suppressed
[ 1759.948252] binder: undelivered TRANSACTION_COMPLETE
14:04:09 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0189436, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1759.996066] binder_release_work: 20 callbacks suppressed
[ 1759.996072] binder: undelivered TRANSACTION_ERROR: 29189
[ 1760.025432] binder: send failed reply for transaction 563, target dead
14:04:09 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffe4]}, 0x2c)

[ 1760.048932] binder: send failed reply for transaction 564 to 13905:13908
14:04:09 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40046305, 0xfdfdffff00000000}], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1760.133181] binder: BINDER_SET_CONTEXT_MGR already set
[ 1760.151507] binder: 13930:13936 ioctl 40046207 0 returned -16
[ 1760.168401] binder_alloc: 13930: binder_alloc_buf, no vma
14:04:09 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000]}, 0x2c)

14:04:09 executing program 5:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000200)=0xf8c6)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x223)
r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x7f, 0x608000)
setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000040)="cc4b9fc462b2a28ff76bef277993fcf3", 0x10)
setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r1, 0x84, 0x12, &(0x7f0000000080), 0x4)
openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000340)='/proc/thread-self/attr/exec\x00', 0x2, 0x0)
bind(r1, &(0x7f0000000100)=@un=@abs={0x1, 0x0, 0x4e24}, 0x80)

[ 1760.179720] binder: undelivered TRANSACTION_COMPLETE
[ 1760.185295] binder: send failed reply for transaction 569, target dead
[ 1760.250714] binder: undelivered TRANSACTION_ERROR: 29189
[ 1760.257151] binder: 13939:13946 Acquire 1 refcount change on invalid ref 0 ret -22
[ 1760.340445] binder: undelivered TRANSACTION_ERROR: 29189
14:04:09 executing program 3:
r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100)='/dev/infiniband/rdma_cm\x00', 0x2, 0x0)
write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={<r1=>0xffffffffffffffff}, 0x106}}, 0xc0)
write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000040)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x0, @dev, 0x4}, {0xa, 0x0, 0x0, @ipv4={[], [], @multicast1}}, r1}}, 0x48)
write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000180)={0x3, 0x40, 0xfa00, {{0x2, 0x0, 0x0, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x60000060, 0x0, 0x0, 0x0, 0x0, 0x3f00000000000000]}}, {0x2, 0x0, 0xfffffffffffffffd, @local}, r1}}, 0x48)

14:04:09 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xda0]})

14:04:09 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc020660b, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:09 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000000]}, 0x2c)

14:04:09 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x3, 0x0, &(0x7f0000000040)="ea"})

[ 1760.689844] binder_transaction: 29 callbacks suppressed
[ 1760.689859] binder: 13957:13960 transaction failed 29189/-22, size 0-0 line 2896
[ 1760.696593] binder_alloc: binder_alloc_mmap_handler: 13958 20005000-20009000 already mapped failed -16
14:04:09 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]}, 0x2c)

[ 1760.739832] binder: BINDER_SET_CONTEXT_MGR already set
14:04:09 executing program 3:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x0, 0x0)
readv(r0, &(0x7f0000000200)=[{&(0x7f0000000180)=""/67, 0x43}], 0x1)

14:04:09 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}, 0x2c)

[ 1760.793735] binder_alloc: 13958: binder_alloc_buf, no vma
[ 1760.800462] binder: undelivered TRANSACTION_ERROR: 29189
[ 1760.811122] binder: undelivered TRANSACTION_COMPLETE
[ 1760.816747] binder: 13958:13964 ioctl 40046207 0 returned -16
[ 1760.824152] binder: 13957:13960 transaction failed 29189/-3, size 0-0 line 3035
14:04:09 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1100]})

14:04:09 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}, 0x2c)

[ 1760.852969] binder: undelivered TRANSACTION_ERROR: 29189
14:04:09 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x3f00, &(0x7f0000000040)="ea"})

[ 1761.002914] binder: 13991:13993 transaction failed 29189/-22, size 0-0 line 2896
[ 1761.019377] binder: 13991:13993 transaction failed 29189/-22, size 0-0 line 2896
[ 1761.027399] binder: 13991:13994 Acquire 1 refcount change on invalid ref 0 ret -22
14:04:10 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
io_setup(0x80, &(0x7f0000000100)=<r0=>0x0)
io_pgetevents(r0, 0x7, 0x3, &(0x7f0000000200)=[{}, {}, {}], 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x6f8}, 0x8})
futex(&(0x7f000000cffc), 0xa, 0x0, 0x0, 0x0, 0x223)
r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vga_arbiter\x00', 0x800, 0x0)
ioctl$IMSETDEVNAME(r1, 0x80184947, &(0x7f0000000080)={0x9, 'syz1\x00'})

14:04:10 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306203, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:10 executing program 3:
seccomp(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0xffffffff}]})
perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
write$cgroup_pid(0xffffffffffffffff, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
syz_execute_func(&(0x7f00000001c0)="cd8075fcb0b06969ef69dc00d9c4017d50ee8adcd0d01192000880410fd1b0b5d90000797c2a0f0fcdc4e3a95fd965eae23c3b4d4d408064797f41dfdf400f01efe5e59d7d2f2f1c0a1a63460fc4c161fccddfde9f")

14:04:10 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}, 0x2c)

14:04:10 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1200]})

14:04:10 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x1000000, &(0x7f0000000040)="ea"})

[ 1761.110593] binder: undelivered TRANSACTION_ERROR: 29189
[ 1761.169885] binder: 14004:14008 ioctl c0306203 20000100 returned -22
[ 1761.197505] kauditd_printk_skb: 1874 callbacks suppressed
14:04:10 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000]}, 0x2c)

[ 1761.197517] audit: type=1326 audit(1551103450.199:3304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=14003 comm="syz-executor.3" exe="/root/syz-executor.3" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45ac8a code=0xffff0000
[ 1761.273769] binder_alloc: binder_alloc_mmap_handler: 14004 20005000-20009000 already mapped failed -16
[ 1761.295149] binder: BINDER_SET_CONTEXT_MGR already set
14:04:10 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000]}, 0x2c)

14:04:10 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1b00]})

[ 1761.319202] binder: 14004:14018 ioctl 40046207 0 returned -16
[ 1761.337381] binder: 14004:14023 transaction failed 29189/-3, size 0-0 line 3035
[ 1761.383739] binder: undelivered TRANSACTION_ERROR: 29189
[ 1761.389345] binder: send failed reply for transaction 582 to 14004:14008
14:04:10 executing program 5:
r0 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x400, 0x0)
ioctl$PERF_EVENT_IOC_RESET(r0, 0x2403, 0x78)
clock_gettime(0x0, &(0x7f0000000100)={<r1=>0x0, <r2=>0x0})
setsockopt$RXRPC_SECURITY_KEY(r0, 0x110, 0x1, &(0x7f0000000280)='system\x00\xd8\xd9\xe6\f\xe1\x03m\xa4p\x83\xf8\x0e\x0e\x84\xf3=j7\xbfo\xe5Q\xa3?w\x90Rr\xaa+\xea\x11I\xba\xe8cr\x16.Q\xab\xdfs\xc3g\xff\xd8Z\x1e\xd3tK\xc6\x8b$Je\x1eB\xa2\x94\x1d/B\x84N\xedG\x01?}\x95%\xceQ\x90,\x95\xf7\x85\xbb#\"R\x9c\xe1\x05\f\x1f\xa9h\x92\xc4k\x88i\x9eD\xd0\xac\xb7\x84z\x91\xab\xd4\xe0\xcdR\xd3\xfa\xf1F<\x82p\x15\xf9\x8d\x87\xb2?\xe1m\xeaJ/E]\b\xb4\x89~zN\x90x\xd08\x000p\x9a\x85\x1f\r\xc8\xf5\x8c\x1c\x94\xb6U\x9f\x92K\x02\xc6\xbd\xbff\xad\xca\xa8\xceC\x18\xa4#95N83oNu\xdaC\n\x8a\xf1\xa7=\\p\x10\xb6\xe6+\xe2\x8b\x10\x00g\x87\xde4\x8b\x86\xbe\xba\xa71=`R\xfd\xdbm\x944\x01\x12\xec9E\xbc\b\xdc<\xcbh\xbcE\a\x86j\x1b\xce\xee\xf2\x84\x14wS\x7f\xc0&_\x19\xf3\xcf\xdc]\x1f\x88j\xb9N', 0x58)
ioctl$DRM_IOCTL_AGP_ENABLE(r0, 0x40086432, &(0x7f0000000240)=0x10000)
futex(&(0x7f0000000080)=0x2, 0x3, 0x2, &(0x7f0000000140)={r1, r2+30000000}, &(0x7f0000000200)=0x2, 0x1)
futex(&(0x7f000000cffc)=0x2000000000000004, 0x0, 0x4, &(0x7f00000000c0)={0x77359400}, 0x0, 0x0)
futex(&(0x7f0000000000), 0xa, 0x0, 0x0, 0x0, 0x223)
writev(0xffffffffffffffff, &(0x7f0000000440)=[{&(0x7f00000003c0)="cfcb2c38ff0865bff5d2afbb25166b16b8cc5cd8593223f41425d8a84ed778c316e56ad2d3ee19bf1aa4bdebb80bcc698f5fc387fea1e7724ee0f2ff6653d88eef1f0dbd612a997f181a76711d3e0da17cec381e7547d8be6fcd3fd28ef8310c461a60ae0b50f0", 0x67}], 0x1)
ioctl$RTC_EPOCH_SET(r0, 0x4008700e, 0x8e4)
r3 = semget$private(0x0, 0x2, 0x80)
clock_gettime(0x0, &(0x7f00000001c0)={<r4=>0x0, <r5=>0x0})
semtimedop(r3, &(0x7f0000000180)=[{0x1, 0x5, 0x1000}, {0x1, 0x23fde8a, 0x1000}, {0x7, 0x5, 0x1800}, {0x0, 0x5, 0x800}, {0x1, 0x0, 0x800}], 0x5, &(0x7f0000000480)={r4, r5+30000000})

14:04:10 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x12, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1761.427793] binder: send failed reply for transaction 583 to 14011:14012
[ 1761.435106] binder: 14011:14012 ioctl c0306201 20000100 returned -14
[ 1761.459345] binder: 14011:14035 transaction failed 29189/-22, size 0-0 line 2896
[ 1761.467157] binder: undelivered TRANSACTION_COMPLETE
14:04:10 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000]}, 0x2c)

[ 1761.487404] binder: undelivered TRANSACTION_ERROR: 29189
[ 1761.506327] binder: undelivered TRANSACTION_ERROR: 29189
[ 1761.530693] binder: undelivered TRANSACTION_ERROR: 29189
14:04:10 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000]}, 0x2c)

14:04:10 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1e01]})

[ 1761.599227] binder: 14041:14042 transaction failed 29189/-22, size 0-0 line 2896
[ 1761.646540] binder: 14041:14044 unknown command 0
[ 1761.680773] binder: 14041:14044 ioctl c0306201 20000100 returned -22
[ 1761.718007] binder_thread_release: 2 callbacks suppressed
[ 1761.718017] binder: release 14041:14044 transaction 589 out, still active
[ 1761.741055] binder: undelivered TRANSACTION_COMPLETE
[ 1761.842018] binder_send_failed_reply: 1 callbacks suppressed
[ 1761.842025] binder: send failed reply for transaction 589, target dead
[ 1761.958079] audit: type=1326 audit(1551103450.959:3305): auid=4294967295 uid=0 gid=0 ses=4294967295 subj==unconfined pid=14003 comm="syz-executor.3" exe="/root/syz-executor.3" sig=31 arch=c000003e syscall=228 compat=0 ip=0x45ac8a code=0xffff0000
14:04:11 executing program 3:
r0 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x6}, 0x1c)
sendmmsg(0xffffffffffffffff, &(0x7f0000001e80)=[{{&(0x7f00000002c0)=@in={0x2, 0x0, @broadcast}, 0x80, 0x0}}], 0x1, 0x0)
sendmmsg(r0, &(0x7f0000000440), 0x400000000000211, 0x810)

14:04:11 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x3f000000, &(0x7f0000000040)="ea"})

14:04:11 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000]}, 0x2c)

14:04:11 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3400]})

14:04:11 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x3f00, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:11 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, 0x2c)

14:04:11 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a00]})

14:04:11 executing program 5:
socket$kcm(0x10, 0x5, 0x10)
r0 = socket$kcm(0xa, 0x6, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x0)
getpid()
socketpair(0x0, 0x0, 0x8, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x20000400000037, 0x0, 0xffffffffffffffff}, 0x2c)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
r1 = socket$kcm(0xa, 0x2, 0x73)
sendmsg$kcm(r1, &(0x7f00000003c0)={&(0x7f0000000000)=@nl=@unspec, 0x80, 0x0}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuacct.usage_sys\x00', 0x0, 0x0)
r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup/syz1\x00', 0x200002, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000300)='cgroup.events\x00', 0x0, 0x0)
openat$cgroup_ro(r0, &(0x7f0000000340)='pids.events\x00', 0x0, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='rdma.current\x00', 0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000c00)='syz0\x00', 0x200002, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000c40)='memory.swap.current\x00', 0x0, 0x0)
r4 = openat$cgroup_ro(r2, &(0x7f00000004c0)='\x00\x82\x19hm\xaf\xd6\x1eq\xa1\xae\x9asB\x19\xcdN\t?\xba^|\x9f@Z\xe2\x0f\xbc \xa2/Bi\x0e\x84\xadU(\x0eh\x97\x18H,\x96\xa0&\x02E\t\xa5q\xdc\xcf\x1b\xcf\x895\xa2\xf8Y\xf5\x99\xc4\x11A\x8dX\xf0\xebb\x93\v\xa9\xb3\xe9\x06\xc4\xa7G\xcbZ\x14\xc7~\x98\x93\xdb\x1b\xf0\xd7\xe7x\xebs\x970\xc2\xf8j\x80:\x1b\xfe=\xd1H\xe1\x04\xecQ\xe8o\x8e(\x87\xb9\x1da\xcaI\x19\xc4%3\x9d\xcb}\xa0m\'\x02A$[\xe8v\r+4\x11Nq\x88\xb1\xa8,\xf2\x1d\xa2}\x82\xcdgf\n\xab\xf5?C\x9eQ\x8b\x87\x1f\xb9b_\xd7\x89\xde\xe3\xf4\a\x1eR\xf6\x86\x99\x99\xb38\x0f \xbc2\t\xdd\x137)\x8f\xc7$\xc6\x1d/\x93\xb3\x06\xb8\x93<C\xbc\x94\xb7\x04W\xf2\x83\x1c\xb1', 0x0, 0x0)
ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x0)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000200)={r3, 0x488ca9744f0f948a, 0x0}, 0x4)
recvmsg(r0, 0x0, 0x2)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f00000000c0)=r1, 0x4)
ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='/dev/net/tun\x00', 0x0, 0x0)
r5 = openat$tun(0xffffffffffffff9c, 0x0, 0x400000, 0x0)
ioctl$TUNSETIFINDEX(r5, 0x400454da, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40004}, 0x4001)
socketpair(0x0, 0x0, 0x100000000000, &(0x7f0000000900))
ioctl$TUNSETTXFILTER(r3, 0x400454d1, &(0x7f0000000580)=ANY=[])
socketpair(0x9, 0x5, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x4, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00'})
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000440)='lo\x00\x96o\xd6Q\xb9Y\xa9dJ,\x00\xd2\x97\x04\x03\xdc\r')
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000680)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1\x81\x96\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xfa4\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')

14:04:11 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000]}, 0x2c)

14:04:11 executing program 3:
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0)
sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="020500090e0000000000e1000005000005006a00000000000a0000000013256fb30b6850a854ffffff00000000000000000b0000000000000200010000000000000000020000d0f605000500000000000a00000000000000ffe7001f0002000000000000000000170000000000000000"], 0x70}}, 0x0)
sendmmsg(r0, &(0x7f0000000180), 0x400000000000004, 0x0)

14:04:11 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3b00]})

14:04:11 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00000000000000]}, 0x2c)

14:04:11 executing program 3:
perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x41, 0x8001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$sock_inet_SIOCGIFBRDADDR(0xffffffffffffffff, 0x8919, 0x0)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f000001b000)={@multicast2, @remote, @loopback}, 0xc)
preadv(0xffffffffffffffff, &(0x7f0000001380)=[{&(0x7f0000001200)=""/148, 0x94}], 0x1, 0x0)
r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/mcfilter\x00')
preadv(r1, &(0x7f0000000480), 0x10000000000002a1, 0x10400003)

[ 1762.499900] device lo entered promiscuous mode
[ 1762.837998] binder_alloc: binder_alloc_mmap_handler: 14062 20005000-20009000 already mapped failed -16
[ 1762.849931] binder: 14065:14107 transaction failed 29189/-3, size 0-0 line 3035
[ 1762.856577] binder: BINDER_SET_CONTEXT_MGR already set
[ 1762.864277] binder: 14062:14105 ioctl 40046207 0 returned -16
[ 1762.877020] binder: 14062:14104 transaction failed 29189/-3, size 0-0 line 3035
14:04:11 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0xfdfdffff, &(0x7f0000000040)="ea"})

14:04:11 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f00]})

14:04:11 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00000000000000]}, 0x2c)

[ 1762.887876] binder: release 14065:14066 transaction 593 out, still active
[ 1762.908517] binder: undelivered TRANSACTION_COMPLETE
[ 1762.927404] binder: send failed reply for transaction 592 to 14062:14063
[ 1762.968985] binder: send failed reply for transaction 593, target dead
[ 1763.007135] binder: undelivered TRANSACTION_COMPLETE
[ 1763.075211] binder: 14114:14116 transaction failed 29189/-22, size 0-0 line 2896
14:04:12 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x1000000, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:12 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00000000000000]}, 0x2c)

14:04:12 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001]})

[ 1763.136824] binder: 14114:14118 Acquire 1 refcount change on invalid ref 0 ret -22
[ 1763.230757] binder: 14114:14118 Acquire 1 refcount change on invalid ref 0 ret -22
[ 1764.043283] binder_alloc: binder_alloc_mmap_handler: 14128 20005000-20009000 already mapped failed -16
[ 1764.059796] binder: BINDER_SET_CONTEXT_MGR already set
[ 1764.066598] binder: 14128:14139 ioctl 40046207 0 returned -16
[ 1764.078301] binder_alloc_new_buf_locked: 3 callbacks suppressed
[ 1764.078309] binder_alloc: 14128: binder_alloc_buf, no vma
[ 1764.098736] binder: release 14128:14129 transaction 599 out, still active
[ 1764.106249] binder: undelivered TRANSACTION_COMPLETE
[ 1764.118435] binder: send failed reply for transaction 599, target dead
14:04:15 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0xfffffdfd, &(0x7f0000000040)="ea"})

14:04:15 executing program 5:

14:04:15 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4800]})

14:04:15 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}, 0x2c)

14:04:15 executing program 3:

14:04:15 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x3f000000, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:15 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00000000000000]}, 0x2c)

[ 1766.240810] binder_transaction: 1 callbacks suppressed
[ 1766.240826] binder: 14142:14147 transaction failed 29189/-22, size 0-0 line 2896
14:04:15 executing program 3:

14:04:15 executing program 5:

14:04:15 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x100000000000000, &(0x7f0000000040)="ea"})

[ 1766.305412] binder_release_work: 6 callbacks suppressed
[ 1766.305417] binder: undelivered TRANSACTION_ERROR: 29189
[ 1766.336301] binder: release 14142:14153 transaction 605 out, still active
[ 1766.372591] binder: undelivered TRANSACTION_COMPLETE
14:04:15 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4900]})

14:04:15 executing program 5:

14:04:15 executing program 3:

14:04:15 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000]}, 0x2c)

14:04:15 executing program 5:

14:04:15 executing program 3:

[ 1767.033381] binder: BINDER_SET_CONTEXT_MGR already set
[ 1767.038827] binder: 14141:14179 ioctl 40046207 0 returned -16
[ 1767.039051] binder_alloc: binder_alloc_mmap_handler: 14141 20005000-20009000 already mapped failed -16
[ 1767.055089] binder_alloc: 14141: binder_alloc_buf, no vma
[ 1767.060983] binder: send failed reply for transaction 603 to 14141:14150
[ 1767.068046] binder: 14141:14179 transaction failed 29189/-3, size 0-0 line 3035
[ 1767.068617] binder: send failed reply for transaction 605, target dead
14:04:16 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x100000000000000, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:16 executing program 5:

14:04:16 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6005]})

14:04:16 executing program 3:
socket$inet(0x2, 0x0, 0x0)
openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$VIDIOC_ENCODER_CMD(0xffffffffffffffff, 0xc028564d, 0x0)
openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KDSKBSENT(0xffffffffffffffff, 0x4b49, 0x0)
mkdir(&(0x7f0000000100)='./file0\x00', 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0)
r1 = fanotify_init(0x0, 0x0)
fanotify_mark(r1, 0x11, 0x10, r0, 0x0)
fanotify_mark(r1, 0x10000007e, 0x2, r0, 0x0)

14:04:16 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1100000000000000]}, 0x2c)

[ 1767.082655] binder: send failed reply for transaction 606 to 14161:14162
[ 1767.089820] binder: 14161:14162 ioctl c0306201 20000100 returned -14
[ 1767.089846] binder: undelivered TRANSACTION_ERROR: 29189
[ 1767.104269] binder: 14161:14162 transaction failed 29189/-22, size 0-0 line 2896
[ 1767.112078] binder: 14161:14181 Acquire 1 refcount change on invalid ref 0 ret -22
[ 1767.140055] binder: undelivered TRANSACTION_COMPLETE
[ 1767.167531] binder: undelivered TRANSACTION_ERROR: 29189
[ 1767.191748] binder: undelivered TRANSACTION_ERROR: 29189
[ 1767.215793] binder: undelivered TRANSACTION_ERROR: 29189
14:04:16 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x3f00000000000000, &(0x7f0000000040)="ea"})

14:04:16 executing program 5:
ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa03, 0x0)
ioctl$VIDIOC_ENCODER_CMD(0xffffffffffffffff, 0xc028564d, 0x0)
openat$full(0xffffffffffffff9c, 0x0, 0x0, 0x0)
mkdir(&(0x7f0000000100)='./file0\x00', 0x0)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0)
r1 = fanotify_init(0x0, 0x0)
fanotify_mark(r1, 0x11, 0x10, r0, 0x0)
fanotify_mark(r1, 0x10000007e, 0x2, r0, 0x0)
ioctl$KVM_X86_SET_MCE(0xffffffffffffffff, 0x4040ae9e, 0x0)

14:04:16 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1200000000000000]}, 0x2c)

14:04:16 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6105]})

14:04:16 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:16 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40106308}], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:16 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1300000000000000]}, 0x2c)

[ 1767.410885] binder: BINDER_SET_CONTEXT_MGR already set
[ 1767.437786] binder: 14210:14213 ioctl 40046207 0 returned -16
[ 1767.457577] binder: release 14210:14213 transaction 614 out, still active
[ 1767.488826] binder: undelivered TRANSACTION_COMPLETE
[ 1767.514201] binder: 14216:14218 BC_INCREFS_DONE u0000000000000000 no match
[ 1767.955153] binder: BINDER_SET_CONTEXT_MGR already set
[ 1767.960848] binder_alloc: binder_alloc_mmap_handler: 14190 20005000-20009000 already mapped failed -16
[ 1767.967177] binder: 14190:14224 ioctl 40046207 0 returned -16
[ 1767.976770] binder: send failed reply for transaction 611 to 14190:14192
[ 1767.984227] binder: send failed reply for transaction 612 to 14204:14205
[ 1767.991169] binder: send failed reply for transaction 614, target dead
[ 1767.991207] binder: 14204:14205 ioctl c0306201 20000100 returned -14
14:04:17 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x3f00000000000000, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:17 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7005]})

14:04:17 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:17 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1400000000000000]}, 0x2c)

14:04:17 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40106308}], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1767.997861] binder: send failed reply for transaction 615 to 14216:14218
[ 1768.004572] binder: undelivered TRANSACTION_COMPLETE
[ 1768.004587] binder: undelivered TRANSACTION_ERROR: 29189
[ 1768.039265] binder: 14204:14225 Acquire 1 refcount change on invalid ref 0 ret -22
[ 1768.039276] binder: 14204:14205 transaction failed 29189/-22, size 0-0 line 2896
[ 1768.085417] binder: undelivered TRANSACTION_ERROR: 29189
[ 1768.092333] binder: release 14226:14227 transaction 618 out, still active
[ 1768.099430] binder: undelivered TRANSACTION_COMPLETE
[ 1768.110803] binder: BINDER_SET_CONTEXT_MGR already set
14:04:17 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1500000000000000]}, 0x2c)

14:04:17 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0xfdfdffff00000000, &(0x7f0000000040)="ea"})

[ 1768.143677] binder: 14228:14232 ioctl 40046207 0 returned -16
[ 1768.147222] binder: 14236:14237 BC_INCREFS_DONE u0000000000000000 no match
[ 1768.169813] binder: undelivered TRANSACTION_ERROR: 29189
14:04:17 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0x40046208, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:17 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1800000000000000]}, 0x2c)

14:04:17 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7105]})

[ 1768.254781] binder: send failed reply for transaction 618, target dead
[ 1768.265163] binder: send failed reply for transaction 619 to 14236:14237
[ 1768.298889] binder: 14244:14245 transaction failed 29189/-22, size 0-0 line 2896
[ 1768.300290] binder: send failed reply for transaction 620 to 14228:14239
[ 1768.315945] binder_alloc: binder_alloc_mmap_handler: 14228 20005000-20009000 already mapped failed -16
[ 1768.338266] binder: 14244:14245 ioctl c0306201 20000100 returned -14
14:04:17 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40106308}], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1768.348108] binder_alloc: 14228: binder_alloc_buf, no vma
[ 1768.372619] binder: 14228:14232 transaction failed 29189/-3, size 0-0 line 3035
[ 1768.380236] binder: BINDER_SET_CONTEXT_MGR already set
[ 1768.385570] binder: 14248:14252 ioctl 40046207 0 returned -16
[ 1768.388376] binder_alloc: 14228: binder_alloc_buf, no vma
[ 1768.397448] binder: undelivered TRANSACTION_COMPLETE
[ 1768.411707] binder: 14244:14245 transaction failed 29189/-3, size 0-0 line 3035
14:04:17 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00000000000000]}, 0x2c)

[ 1768.412112] binder: undelivered TRANSACTION_ERROR: 29189
[ 1768.421282] binder_alloc: 14228: binder_alloc_buf, no vma
[ 1768.451803] binder_alloc: 14228: binder_alloc_buf, no vma
14:04:17 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x630b}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1768.466380] binder: 14248:14258 transaction failed 29189/-3, size 0-0 line 3035
[ 1768.474863] binder: 14257:14260 transaction failed 29189/-3, size 0-0 line 3035
[ 1768.475941] binder: undelivered TRANSACTION_ERROR: 29189
[ 1768.504182] binder: 14257:14264 BC_INCREFS_DONE u0000000000000000 no match
14:04:17 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x400880, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x40, 0x0, &(0x7f0000000080)="b143c0846d82d70929eb0cece677733ace74f3be2b24e79a26f9a8aeb0b0151f322bc3c3095c1fbc10d3a9aa170b886b858c4644aa29b3b96b27902dc9d7136c"})

14:04:17 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7205]})

14:04:17 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe4ffffff00000000]}, 0x2c)

[ 1768.587801] binder: 14267:14268 ERROR: BC_REGISTER_LOOPER called without request
[ 1768.612978] binder: BINDER_SET_CONTEXT_MGR already set
[ 1768.630172] binder: 14267:14268 unknown command 0
14:04:17 executing program 3:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000001600)='/dev/kvm\x00', 0x400200, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000340)='/dev/sequencer\x00', 0x284281, 0x0)
getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffff9c, 0x84, 0xf, &(0x7f0000000440)={<r4=>0x0, @in6={{0xa, 0x4e20, 0x4, @rand_addr="ecb72d475ff743c60523b2768f94f412", 0x800}}, 0x836, 0x9, 0x0, 0xe0, 0xb2}, &(0x7f0000000380)=0x98)
getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r3, 0x84, 0x1b, &(0x7f0000000500)={r4, 0x1000, "1b45b136eba7938eadc54045e02a3156b22894f38f0c3dae9313d6878729c1b40da4532dfc66d5525726f4308e974f2b7a3a114f19b9dafedfb8f46b187fbbf6b2cd504b71439589d6b428f133534de6b00cbfb24b816f82727494847f505f2ae21b041292ff7b5200dcf7b4ee20b57f7f8d74649fb6de3e275ab27f23ffd76db03c945782603be48d2f32255db030dd7f55dfe0539e2e0a2b54377821bd799a23ae61d0805af33fa57ba9f118f76b549cca40f073086aaf4a6064b200df391e35556809cd3d3fb772168e5e58379e7cc412501103ad5fb07e8300b5b914953568cbbb8d6ca6dee75f49e968049dd50e39825da7444f80af2a755f3ee559f521579dc6fe8ff610bfa2e489adf14e3293787115f5699952ac127dcd7d694dea075f9ad646e0533f3126eea9c9765d1a0e25c43fda0e84fa97ed080ae545ee90318f2b094c88011272f139d5beb092a7c163e1e0ab62cb62ce51dedc49c699502f049936a7e789fe87db245892b2e557186a27e698fb117b6d58348c86f388b64a376fabe48128c14f98dfd190376c9ad749fc2d2e1b0343dd436040401cbce5b7476f39ae3210559b10bb51d00ab92bee82cf5991fb795a0a1823c22b0825a7836fc3f871f8ea703d0dc76bf2dc752b6ca64bb8ac6361c3fc658cdc2f36b7762079ac3614e89c6ef601628ef7535953f1a4ccd4201f8be91de436c15ad69fe46a6502cca4ef05beee947764725fe2b503cbe925e5ac69ddccd005b81260ddc95fa29ad9211039f47799caab15dd6090b10d824c4cd67547524aa80bcf10b35a18022cd64047145ae2971622a2d3e51220810d9450970155629bd3c9410bc405c3061418cb53f6590f949224bc73f7f00258988dc6b32437929bb1acdfbb749964bcbe54e3fed063d3944c641b1d43b4318449bfc49e5c26a0078c4be910f3634da599489f72b18c1a916b52739469a396c306218430a192c810a53fd02069e40d0986e1eb9176cb5ae610d7b14cbda52611e3289728d7289897c0478ff1b4e3dca83ba33b0d9f46512c97b13ae06694f675588c8ab216a7994b38dbb0b5ccf377a0059c547a13ca8e998e28d95242f38135a5f33fac5ab4094ff82a65519901ea5833f3f222ec2150e25e64104aff598d71f2abdcce6fe972fb997f64297296f87cc80fb9f2b55ca69b33110f6de5c2939b5fd31a8fc8c48458f75408fcc8066abd470b2446a8c1f7462481ba903e577e351c0a8165a5a36b8d61108d095dff4f9d2fdf6d19f3565e80447a223dd683bf29fc996268f96751dc9e32aa09ae74445d8d9548c5b1ce18dadd4bfb7cb8b4c62f8644ab6ad580def86eb5180de499a730faae090d2e296ded6838f2b577824e35f01fddfd0de3238f7396ca3a0207dc96bdc8a9bfe927c17768507efc8c8c2cd8d669be3e517c89b26cd7cef6c61edb65ae07be9a08b1b7559c09e569e1bb7546f99797cdd51de2b25bba30fef9c562452d17ec2a1d97c2d0bbea07da7d05a83611e05653e6e886dcbf8e9ac8c11fd23aa80693793c66ead58a91d3bd7d633bc451e92f44dcd341dd5c8ee7af525028966703c31f4db758fcbc69b4ebb1cbd253e22cb88e247491fdff37e198599df9180e3d1aba5a1d3c353977edee990e0dd1ea7bb6e36145a1068c148ad697ee85ebff3ce077c2dcff68fe4105901ccef551f2dd2c4a1b146aeba31e57bf817cbbdb475297a2c3e514701d2b2810fee6f240bdc1622e45c1c41f9948f3674fdc3e0c89d41eae61e07870f38fb40eee348c2655826705e68a2f4ec25261725fd932c62175dc70ca6b0ef504e06c379a5ce2e2873337602dd1c25d956d294f4defc5fc28e5290d993004f3890d06eea420d7466ec53fc352b52e83174adcbbbe59aee3da4cedf59a38151e8ef96e015cb7952bc632b9a920d6b123b13a479fb1f4034161a564420f6b6ccf0535e129a2d386ce8aa7b01dd45706502621bb4dec9c240546d54fa4af7457f0621082e1f2e70febc4ea0c8aa4cc18d5b49ea16084928bd5e1a36e6b4007e1d5189c8170982b89e4be19cba93b4734f7bd063dce97868c3d5c1624d40b135b8e6c5eae951600b1d7e6c9b73d452e727680aa34860f4d84211f2bda5584a4410899bb86caeb0e053aa5eb3c1816b3bc17a39e986282329219bb9d4719d4fe640c99bece19272609b80bccdfb1f0a9647daa1cee50d1418cdd91904065899bbe2b958723a1d19c24b51c05e236f1bdbf7789544709f681b6940f178529eb142d97d496476948ea32854d988a3e7223ea82f65cf03420381c433284cdc25bd82c4e2c97a3295b273bfdd9f9733960f21dc88a3634daef0518b3e576d1ceb49727c13b2dfc385394d336e69d29368d3551177efdd84301c521b8f1586449f08ea2a267885c1ec4c057dcbf10e84a3e81e53d63ff4bd3c1c0c1f1e8823919609443f16072f1ef9a69da6e6a14a448499c105ac64ef708330f18bf140184115a8163aced6e99ce951c1f6e9cd60e3b9b25aace1c24911db870f905778663fff4151bbb58a92eb531788484f7e8e7632d3eea082bf17e5095e202500aa26fa396041981a8d32ded37c3824a9ef3be86274eba577389ef727e10a9ae893bb444176a2eb3073d62363d82a70c16761d6cb31a62f0ea3509a7437bb153fb290955aa8119ee6262948a91031ba47669e5fa931d36c1bb56e6f119202463e202070c6a64e5a6d59025d8fbc64b8779253a2483e31b3f0c18e9ba910178ad83d493c36ea254e011edfe34fa96f0e7ebaa028420a2b253ddaf270d13c801b8822352f7b5ab51eb734529eda6478e4c98999f0e7067e46a131bbfde8cbf6f2144bab854bca18d726a482fe9ef43fbddaa218b28de7357184a8fce1e6020f200110b414f437cfbc26a9e942a484255b81f42309f46290dd9c29678c63cbdb6e09b1bbcf27688cd5667d987955046b9e81ac2e0b4d1097b9a2cdc593d3bbbe4a2757949432a69575313f953da80844b4f99c653caf7d381d252a0a0e568cf9c62a95e90f26b1826fbafb84e30cd4c33bc20dadbf9fe0efec30b51b265cc1de0ac34b7cf6e965248cb48def8b88e3dd54069c438f9ca29dc6ffb1c991b59b15b5b9efe4e2538b17befd6538232a5c486c5460e1305e759244a3c01221f6d17d9236cb86c5d5d4cf0dfea81d883344ec5dab2f55db2e9d273db21a81f18f2bffb74c2696753a5982920971054137360f655be6df1458a0eb80b70438b30ae10fbec350e6a7bb78015bea0a6ae92deb7fdb211f95580d028ba5fc2b67156eb0a343e3a585c91338a1a6d4bb386132f162c20f54063068f86e293a45ee1bba46906cee99ed33a3535b66908c5abee5a5a29817884b5e569d5377478a5170b4b7a89c2d6fdc547e0138eda7b8055d15ded54944a91c1bd30552151ec2d09e312cf9d3e5e8f7e72fe188fa696393ee9294e677fa0f33ef6bd50aabc54385176c837eb5f7b1d094f63f9dce3ac5e52d79e00be71d2bc6a023f9aa26525dffac5ad561781ee4f63bd86004887acd18cb32288bb508d51b3007b930dac35d072f1a358b1a7dcba02c717cf79486c47801ade3e467499fc8deb37c0d7353980cbe514eb0e7929523060e8deeec9f96f7786c79ff8e69738938a1d69d3f36dc8b4c15ae0707fd564f10b2c22142da4eba3189d7a56ccd7da67ccf818f42e890b9212d29e3770dbae9420a71cf94ddcd448d1fea046b0ef74c7b2ae8c4d00f8d6e40b0f4d5b3a8cbad4f9616498a2120ccf5f4ea033a905069c0c70edec5070f447918f13cdefaf07843745fdab882b74c2592accb8b7003f444f7b79b2bc83f07679a40df0ddf9ea36686014a4bdb6a712d2fa13868525cee80023e4cb2f834d43bba73b6368d062aed51a6696511e730fc812e112385cca4962cc84c353d85e3758d00334f0085dc04952c45e568a2d89002f79991b6c15b3ccf1f33e75650662dacc3a99e573e721c69db2b0ae89bbb371aa9bb054873d5717b90c282bcb1b8ee59da1c3649f0495f1d60e48be74464be9101fba23753317dadd9ffe35d5c30396d899ee18363f2e0c6421398c3fdd1e0573c8f4f6ddccf31e2f602869906804f6e2fa8c7cbf5af07e32c34beea7a669c3c30cff6d34e23ba4221bc35a588463bb6a82df6e026198cf968b5b3804f60776a7bb34c22f130d14be289150e70d2f67c3309aa155d47a798431e2bb822eded1d4cd8f6862afcf9f3e97891c62ceb35d4d84d65c83ea15c914b2be46afd81fa1a8fccfaef9911fdf2b3cb8837e27572298af1f71c8da3c477a5c2b5a8c174860a73883d5e346547d99fc81b38edca351381bd81438756516c5ced6ead3b8de01db8aab6ca2dde961603f18d58d848160c8c21d9fa4ebfade170193d5fc57cfb16d59f150b652051185e4ba7e8fe637ee42c2c797dd77fb2ea957e86a7d56dee2d51f0d8715c42b65cd3c57720d0ac333f081421d480e2cdcfd1d2922d808eecc96dae124b453e40ee806b6b9b75b68c3a3348cd5d125ed67c736496746fc9d0035c04fb748692d90e88bb9e5439609d914df2c0f70c434b531b8766d242fdf2d0709e18a161c862806d232da92663aee1e30081b2336a83003d6399c29322e02fe802ddb6320f686b601032f3af769aeb476eb7eb57ec965ddd6c4e3f7418182ee50661fb10c2ab8c12d18ae4b0391ec6e97167dbf19afb4923dba385ba0ae9e65bea1fee3217688fb90fd59381674863c3ef27cce50b304c7f69037499d4c9341dafa7a69ed4dc763db556c3433b09fb5a249faad769c57d6e33a45ac18e76768dbdd33ac9044ec21e7cc4e71df30ab1c6f05806f378ac8187deae02ec07b6dcea0d6c95ba026e5e82648f53e67ee8c6d593f81294a44bb1c31c42bff024578e35e570109e800cb06c66c1e2b4a92759923d986f7767692b22117f8c2629c7da208d60adb64e363155a2107d52925c1289486a1e4069bb9ec51c1d981fb29fdfb1d9d3dfd5edbcb4cc73192208ced9885ddef2f3cfbef8d1112390726416d116ae9391b92c392878e6e27acf126a844b389f2bcf42b86afe9a3e99adc2ad466bafd00792d8eb8ed4b1b591c060efefb223c1b24e9f9ea8a3abad7ad3157b81d820becec0ded30de407f790f5fa1bfe443604cc355a535c8238e36e2837c9457d839772c4002f435545797c8215069208240f016a912a70abaf7d2a0074fe10b36c8dba75e5998eb0731537764b020432fec3f7ab4557e3ee77cfb454c0d195be55fa9f6d32e5cc99fd6af531137f1873aaaf535790416aa22ef30e9750a2c6895a7abee4b22dc43cf0a93240386958cfee5261f180841e0813f7cfa10c4f5bb9c0ab93bf5c91583c0a30a7835e9bfcd3287f36f62ebc5a301952e788ebe8d2258d49538986a8cd818cbf77d9e301b82f196f8aadfc678c43f05dc4bdbd053b04e941309d97b538d821c7e7b011718f296c21823b0d6bfbcc485b8824f3410fc7c50177e44e07fa18b3eea12a49b066c946e8aa26ad7530db505637050e023ae35aa80fed07f5df6f63b3d81e5156802efefb63746f0b686730e8ff269d0eecfdf243ed437209aa39bb8510bb77bd51e4a2844a9f8125d5fe298689c15b144611e2a66a968021de2193ce82f78fdadcefe2f59576c6f8532adda1c5b6bf99f5a6318dea2c5bef03891ef3da2c9a5b549d79a281b25d6eaf4c1b9ebc2e47ef4642dd4ae81bf3fee2906ca34ba62fe506315dc8be286398531b584ce0a7b7a61a32b8989fc5763b6cc696db45ac221342746315b"}, &(0x7f00000003c0)=0x1008)
r5 = syz_open_dev$amidi(&(0x7f0000000080)='/dev/amidi#\x00', 0x4, 0x4000)
bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000280)={r5, &(0x7f00000000c0)="9e9e72d076583d7185d6c6be8854021871adf863090c401f1ce1500772850b970f587e3fd4e2f82fda57716abce59416c6dbfae452f16c77f56021623cac19a085feb95535e92729c122eedbf37f6512cc1821d948be77451f90dd8a5a7dfb84adeb9049e541ee9ba144e0235e14fd8bcc353d2504b56aba2f4e526a36d0e6e6768fd03c8469a0324e13a8538d5f15cbc00781330e768026afc5464e9460cb61e3e57f0555d0", &(0x7f00000001c0)="aa1883d0083d236dc0d508e8adb2ecc333f4775a95f3eed6f14c71b69a86e18794c19bb0e3f0155ff9e163b0cf3a39e75897f2591dca447a27056c2f125b16591e39c8072820d466fce21de92ae8353d7c1858b1e4fd2e6506b83f45cb94e97f7bf20534b08e3f9a9695b7ef1d701c880b705ab876ddb8489bffdb4cf19ac480e2a25ed3110df65f35876af0e3ce52bcb76d058ffc9891986e75e7abaa302af8ff16d87d4781170daf171b272d31"}, 0x20)
ioctl$KVM_GET_MSRS(r5, 0xc008ae88, &(0x7f00000002c0)={0x2, 0x0, [{}, {}]})
r6 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vcs\x00', 0x80200, 0x0)
ioctl$RTC_ALM_SET(r6, 0x40247007, &(0x7f0000000040)={0xe, 0x31, 0xe, 0xe, 0x5, 0x1, 0x5, 0x5, 0xffffffffffffffff})
ioctl$RNDZAPENTCNT(r6, 0x5204, &(0x7f0000000300)=0xffffffffffffffff)
ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd9c)
ioctl$KVM_RUN(r2, 0xae80, 0x0)
ioctl$TUNSETLINK(r6, 0x400454cd, 0x0)

[ 1768.640032] binder: 14270:14271 ioctl 40046207 0 returned -16
[ 1768.648785] binder: 14267:14268 ioctl c0306201 20000100 returned -22
14:04:17 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}, 0x2c)

14:04:17 executing program 5:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = socket$inet(0x10, 0x2, 0x0)
sendmsg(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="24000000130007041dfffd946f6105000a0000001f000000000008000800030004000000280000001100ffffba16a0aa1c0900000000000012000000000000eff24d8238cfa47e23f7efbf54", 0x4c}], 0x1}, 0x0)

[ 1768.706816] binder_alloc: binder_alloc_mmap_handler: 14267 20005000-20009000 already mapped failed -16
14:04:17 executing program 3:
r0 = add_key(&(0x7f0000000080)='big_key\x00', &(0x7f00000000c0)={'\xff\xff\xff'}, &(0x7f0000000340)="46ac5128da090e4899c38028efeb85968ead969e21e33725a7edc030260cdb3ca79964a6e93ce51185f005b7dac052cb797af438c32c29b736fb12c63dd0e504445044a1ae9c10fd8171232ed7dcb08e9acaf4c569c4c16c5c47994118fc35ff7f03407dc7093fa7d3132d276a10768b2711cd1c6ecd3545692431856b6e0651412ff7b73711097f061a1b67f6c3d7605eab3b675b6c061e6ef32b7ea8847b6f84da1334d35322b94447bfaca74b152eb64cfa54cb63126c2cc662e7898e6459ed40c4566403f303d341c9c34c6049d9f8e1c2a9483f003c20e66886d0e1629f498668c202f183de294d03da07c9f5feb65bc196554a79a2f255828c1f1cf9a09654f9df849443e8d290debcc78efbdca391a348b33f18ef618011273faa1f095298dd71db08a90e177a1e9a0c771deca3b51670a26850b89d4439574328c19d9e91766dd52169e0ad5011e4acc005861b3b3146d67445e6f6c75ce4af9d8db6963887d79113613267c5bc42fb0aca828590fb291ce8836d3cd391d364efdbb7015d8ec643d83b623380c21c6ebbf774498c94e60838a45d4692bfe73aaea2bbcecb6dcec20e5aa48a950428e2372009212f2f6be608cdec5ff84108f3f3d2e42c99a6d4cd4577ec9f39a51533efe71d494ccadb66eddd4cc0e56b33eefb0ada68ae36c905a977d9042a63299d2130f4e85357b0078c31bc45b00f5ccd879a6735d85882bfddbc6f2cff4a2b976b29e5a8adc74893c748b297a660ba0f64ad8a6ac6fcf180b6a4357ad6733cb75035cd58631142bd720cf52bcd1438647cbe1058e32d33c38f1327bef3f6b1c815ab4f2d47366473ae37c65a2d1df88823dd4c326d640c50e5bddfa976f04cd034331b632cd7a8bbc838081f28f6e24ed646721cea36e56501f9085e428a6c94b7ba5431f59651f36c8f715e4547ffed53c03cc58d2d4382193625cf69c197c4eb3c3c86c291d693837ab7eb23d61d2518379f0c61acf67425afa1ff8d1fac196a7ef9f6f9b514a2028ae010d1bf10833940294c400401ec706ce366dc4c62f6c55c6985a31592360cc7e6cc30a90cae1891b4cffb882b0329457503055db6a8e3b651b3302c24e6d149e8368ee6d3bafbc417256d042b4b87cb1bf46169ad1a593da66b2c6f453180f2c51be35c431e1af07e54c1251334415135422fa81b015a7a746c1979827e3d32057d408016cdc2b641a42626bbf8b7970a5638e9e48783ff80ded5b5184b69d41e60ba9e2ff7ef3e85b4419db2b064d64f833dc2035a6cc3ea28335ad94eb5ba974d9799ce94565559e6a7636b725c4c3dc1702af3c0f3d9dc77f6d404b7c8ff2cec2b4e703451a1d2750d9a22e9f4b5e27da765d228f09bbd30088ac9dff793ec759161849cf4217f5684bff8eddd65be61d3ed2dcc7bae8ab5e1260c3a90cdb37626c4871098802b34f271d8a091b0517bd1588b43cf21b2e3fe676e34d115a56d450d50a97ac7e2ea5904f9695dbde822dba41ac3a1190d63ef486a1829d38b005f9458a82533a555a2f674eea95af7ef7f0cf9654e0ed8d2ab722ca065fd97e6518b76a39cc1b04dc49c395f3aad5e05c76c1881f6a85fee6c6fba8340692eb0b7f3f948350e6947dac635cfef9e4ff4d3f756802cbd97e8c5845b25bc5a021d9875277f197d1bce55661e6961dd788a444962e33fa582a01d0bd61aaa22a76adf68b3169d3f0b49", 0x4c1, 0xfffffffffffffffd)
keyctl$read(0x3, r0, 0x0, 0x0)

[ 1768.776804] binder: BINDER_SET_CONTEXT_MGR already set
[ 1768.803769] netlink: 8 bytes leftover after parsing attributes in process `syz-executor.5'.
14:04:17 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7401]})

[ 1768.823096] binder: 14267:14279 ERROR: BC_REGISTER_LOOPER called without request
14:04:17 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}, 0x2c)

[ 1768.853207] binder: 14267:14285 ioctl 40046207 0 returned -16
[ 1768.861357] binder_alloc: 14267: binder_alloc_buf, no vma
[ 1768.883256] binder: release 14267:14268 transaction 629 out, still active
14:04:17 executing program 3:
r0 = syz_open_dev$ndb(&(0x7f0000000400)='/dev/nbd#\x00', 0x0, 0x800)
r1 = socket$inet6_udp(0xa, 0x2, 0x0)
getsockopt$SO_COOKIE(r1, 0x1, 0x39, &(0x7f0000000080), &(0x7f0000000200)=0x8)
ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f0000000100))
r2 = socket$inet(0x10, 0x3, 0x7)
close(r2)
r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000240)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0)
bind$pptp(r2, &(0x7f0000000040)={0x18, 0x2, {0x3, @multicast2}}, 0x1e)
r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00')
sendmsg$TIPC_NL_NODE_GET(r3, &(0x7f00000003c0)={&(0x7f0000000280), 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x60, r4, 0x0, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_BEARER={0x4c, 0x1, [@TIPC_NLA_BEARER_PROP={0x34, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x200}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x587}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x54}]}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}]}]}, 0x60}, 0x1, 0x0, 0x0, 0x804}, 0x800)
fcntl$getown(r1, 0x9)
fallocate(r0, 0x20, 0x0, 0x6)
getsockopt$inet_sctp_SCTP_RECVNXTINFO(r2, 0x84, 0x21, &(0x7f0000000000), &(0x7f00000000c0)=0x4)

[ 1768.899819] binder: 14267:14279 unknown command 0
[ 1768.905671] binder: undelivered TRANSACTION_COMPLETE
[ 1768.939175] binder: 14267:14268 transaction failed 29189/-3, size 0-0 line 3035
[ 1768.940239] binder: 14267:14279 ioctl c0306201 20000100 returned -22
14:04:17 executing program 5:
r0 = memfd_create(&(0x7f0000000100)='\vem1\xc1\xf8\xa6\x8dN\xc0\xa3\\\xe2\xcb\xa2\xba\xe5\xf4\x97\xac#*\xff', 0x0)
write$uinput_user_dev(r0, &(0x7f0000000280)={'syz0\x00', {}, 0x0, [], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6c06]}, 0x45c)
mmap(&(0x7f0000000000/0x7000)=nil, 0x7000, 0x80000000004, 0x11, r0, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000000)={{0x77359400}, {0x77359400}}, 0x0)
r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040)='/dev/rfkill\x00', 0x8002, 0x0)
ioctl$CAPI_INSTALLED(r1, 0x80024322)

[ 1768.953899] binder: send failed reply for transaction 629, target dead
[ 1768.971061] binder: send failed reply for transaction 630 to 14270:14271
[ 1768.980560] binder: 14270:14271 got transaction to context manager from process owning it
14:04:18 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x630c}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1769.013523] binder: undelivered TRANSACTION_COMPLETE
14:04:18 executing program 0:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000140)=0x7)
r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x800, 0x0)
ioctl$DRM_IOCTL_GET_STATS(r2, 0x80f86406, &(0x7f0000000200)=""/161)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
setsockopt$SO_RDS_TRANSPORT(r2, 0x114, 0x8, &(0x7f00000000c0)=0x3, 0x4)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005ae2c8969b08f1922b8bc8386f8f21c8947e06aea5503f67af47ce6d3a7eaf95678f6b3ddcedba111d6500bc23c64410cccebe98eccce3cc64ce2659c381084149f078dda40b5d1a159bae0dcef8599a6f01d6d129acaa171c5feb690f169256f014362b04b21608feca4b261de58fe884efa930955514c4967bcc81014f47824a63d05dfd84272187fc032280"], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:18 executing program 3:
stat(&(0x7f0000000340)='./file0\x00', &(0x7f00000004c0))
setxattr$security_capability(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)='security.capability\x00', 0x0, 0x0, 0x2)
ioctl$UI_GET_VERSION(0xffffffffffffffff, 0x8004552d, &(0x7f0000000180))
ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, 0x0, 0x0, &(0x7f0000000380)=""/93)
r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41c1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$KVM_SET_TSC_KHZ(0xffffffffffffffff, 0xaea2, 0x0)
getrusage(0x0, &(0x7f0000000640))
r1 = socket$xdp(0x2c, 0x3, 0x0)
r2 = syz_open_dev$radio(&(0x7f0000000100)='/dev/radio#\x00', 0x2, 0x2)
ioctl$VIDIOC_G_STD(r2, 0x80085617, &(0x7f0000000000))
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000ac0)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x9, &(0x7f0000000a80)='keyring]\x00'}, 0x30)
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000440)=@file={0x0, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x40}], 0x1, 0x4000000)
ioctl$int_out(r0, 0x0, 0x0)
ioctl$VIDIOC_S_STD(0xffffffffffffffff, 0x40085618, 0x0)
ioctl$SCSI_IOCTL_GET_IDLUN(r2, 0x5382, &(0x7f00000001c0))
ioctl$TIOCEXCL(r2, 0x540c)
ioctl$SG_GET_VERSION_NUM(0xffffffffffffffff, 0x2282, 0x0)
r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000200)='/proc/self/net/pfkey\x00', 0x0, 0x0)
r4 = syz_genetlink_get_family_id$team(&(0x7f0000000140)='team\x00')
getpeername$packet(r2, &(0x7f0000000400)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000540)=0x14)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000580)={'vxcan1\x00', <r6=>0x0})
getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000700)={{{@in=@remote, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r7=>0x0}}, {{@in6=@local}, 0x0, @in6=@local}}, &(0x7f00000005c0)=0xe8)
getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000000600)={<r8=>0x0, @broadcast, @multicast2}, &(0x7f0000000800)=0xc)
getpeername$packet(r1, &(0x7f0000000840)={0x11, 0x0, <r9=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000880)=0x14)
getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000900)={{{@in6=@mcast2, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r10=>0x0}}, {{@in=@remote}, 0x0, @in=@multicast2}}, &(0x7f0000000a00)=0xe8)
getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000b00)={{{@in=@multicast1, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r11=>0x0}}, {{@in=@multicast1}, 0x0, @in6=@initdev}}, &(0x7f0000000a40)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000cc0)={{{@in6=@dev, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r12=>0x0}}, {{@in=@broadcast}, 0x0, @in6=@remote}}, &(0x7f0000000dc0)=0xe8)
getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000000e00)={{{@in6, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r13=>0x0}}, {{@in6}, 0x0, @in=@multicast1}}, &(0x7f0000000f00)=0xe8)
getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000f40)={{{@in=@dev, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r14=>0x0}}, {{@in=@empty}}}, &(0x7f0000001040)=0xe8)
getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f0000001080)={<r15=>0x0, @rand_addr, @dev}, &(0x7f00000010c0)=0xc)
ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000001100)={'team0\x00', <r16=>0x0})
getsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000001140)={{{@in6=@local, @in6=@ipv4={[], [], @remote}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r17=>0x0}}, {{@in=@multicast1}, 0x0, @in6=@mcast1}}, &(0x7f0000001240)=0xe8)
getpeername$packet(r3, &(0x7f00000012c0)={0x11, 0x0, <r18=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001300)=0x14)
getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000001340)={{{@in6=@local, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r19=>0x0}}, {{@in=@multicast1}, 0x0, @in6=@initdev}}, &(0x7f0000001440)=0xe8)
getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000001480)={{{@in6=@dev, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r20=>0x0}}, {{@in6}, 0x0, @in6=@mcast1}}, &(0x7f0000001580)=0xe8)
getsockname$packet(r3, &(0x7f00000015c0)={0x11, 0x0, <r21=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000001600)=0x14)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000001640)={'vcan0\x00', <r22=>0x0})
recvmmsg(r2, &(0x7f0000007a40)=[{{0x0, 0x0, &(0x7f0000002080)=[{&(0x7f0000001c00)=""/95, 0x5f}, {&(0x7f0000001c80)=""/235, 0xeb}, {&(0x7f0000001d80)=""/147, 0x93}, {&(0x7f0000001e40)=""/175, 0xaf}, {&(0x7f0000001f00)=""/126, 0x7e}, {&(0x7f0000001f80)=""/229, 0xe5}], 0x6, &(0x7f0000002100)=""/4096, 0x1000}, 0x4}, {{&(0x7f0000003100)=@tipc=@id, 0x80, &(0x7f0000003400)=[{&(0x7f0000003180)=""/217, 0xd9}, {&(0x7f0000003280)=""/6, 0x6}, {&(0x7f00000032c0)=""/124, 0x7c}, {&(0x7f0000003340)=""/169, 0xa9}], 0x4, &(0x7f0000003440)=""/175, 0xaf}}, {{&(0x7f0000003500)=@xdp={0x2c, 0x0, <r23=>0x0}, 0x80, &(0x7f0000003740)=[{&(0x7f0000003580)=""/209, 0xd1}, {&(0x7f0000003680)=""/4, 0x4}, {&(0x7f00000036c0)=""/94, 0x5e}], 0x3, &(0x7f0000003780)=""/17, 0x11}, 0x3f9}, {{0x0, 0x0, &(0x7f0000003940)=[{&(0x7f00000037c0)=""/41, 0x29}, {&(0x7f0000003800)=""/74, 0x4a}, {&(0x7f0000003880)=""/12, 0xc}, {&(0x7f00000038c0)=""/60, 0x3c}, {&(0x7f0000003900)=""/22, 0x16}], 0x5, &(0x7f00000039c0)=""/50, 0x32}, 0xec}, {{&(0x7f0000003a00)=@tipc=@name, 0x80, &(0x7f0000003d00)=[{&(0x7f0000003a80)=""/138, 0x8a}, {&(0x7f0000003b40)=""/191, 0xbf}, {&(0x7f0000003c00)=""/99, 0x63}, {&(0x7f0000003c80)=""/70, 0x46}], 0x4, &(0x7f0000003d40)=""/36, 0x24}, 0x8}, {{&(0x7f0000003d80)=@alg, 0x80, &(0x7f0000005000)=[{&(0x7f0000003e00)=""/222, 0xde}, {&(0x7f0000003f00)=""/12, 0xc}, {&(0x7f0000003f40)=""/129, 0x81}, {&(0x7f0000004000)=""/4096, 0x1000}], 0x4, &(0x7f0000005040)=""/250, 0xfa}, 0x1}, {{&(0x7f0000005140)=@rxrpc=@in6={0x21, 0x0, 0x2, 0x1c, {0xa, 0x0, 0x0, @mcast2}}, 0x80, &(0x7f0000005400)=[{&(0x7f00000051c0)=""/7, 0x7}, {&(0x7f0000005200)=""/151, 0x97}, {&(0x7f00000052c0)=""/227, 0xe3}, {&(0x7f00000053c0)=""/39, 0x27}], 0x4}, 0x6f57}, {{&(0x7f0000005440)=@un=@abs, 0x80, &(0x7f0000006740)=[{&(0x7f00000054c0)=""/91, 0x5b}, {&(0x7f0000005540)=""/60, 0x3c}, {&(0x7f0000005580)=""/4096, 0x1000}, {&(0x7f0000006580)=""/179, 0xb3}, {&(0x7f0000006640)=""/210, 0xd2}], 0x5, &(0x7f00000067c0)=""/193, 0xc1}}, {{&(0x7f00000068c0)=@nl, 0x80, &(0x7f0000007940)=[{&(0x7f0000006940)=""/4096, 0x1000}], 0x1, &(0x7f0000007980)=""/149, 0x95}, 0x8ac}], 0x9, 0x2042, &(0x7f0000007c80))
getsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000007cc0)={@dev, @remote, <r24=>0x0}, &(0x7f0000007d00)=0xc)
getsockopt$inet_mreqn(r2, 0x0, 0x24, &(0x7f0000007d40)={@remote, @empty, <r25=>0x0}, &(0x7f0000007d80)=0xc)
ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000007dc0)={'vcan0\x00', <r26=>0x0})
ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000007e00)={'team0\x00', <r27=>0x0})
getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000007e40)={<r28=>0x0, @loopback, @local}, &(0x7f0000007e80)=0xc)
getsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000007ec0)={{{@in, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r29=>0x0}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@multicast1}}, &(0x7f0000007fc0)=0xe8)
getpeername$packet(r2, &(0x7f0000008280)={0x11, 0x0, <r30=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000082c0)=0x14)
getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000008300)={{{@in6=@dev, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r31=>0x0}}, {{@in6=@mcast2}, 0x0, @in6=@ipv4={[], [], @local}}}, &(0x7f0000008400)=0xe8)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000008440)={'ip6_vti0\x00', <r32=>0x0})
getsockopt$inet_pktinfo(r3, 0x0, 0x8, &(0x7f000000aec0)={<r33=>0x0, @initdev, @local}, &(0x7f000000af00)=0xc)
getsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f000000af40)={<r34=>0x0, @initdev, @loopback}, &(0x7f000000af80)=0xc)
getpeername$packet(r2, &(0x7f000000b180)={0x11, 0x0, <r35=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f000000b1c0)=0x14)
sendmsg$TEAM_CMD_PORT_LIST_GET(r1, &(0x7f000000bec0)={&(0x7f0000000080), 0xc, &(0x7f000000be80)={&(0x7f0000008480)=ANY=[@ANYBLOB='l\f\x00\x00', @ANYRES16=r4, @ANYBLOB="00072abd7000fedbdf250300000008000100", @ANYRES32=r5, @ANYBLOB="4402020040000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b00000008000400ffffff7f080007000000000038000100240001006c625f73746174735f726566726573685f696e74657276616c000000000000000800030003000000080004000800000040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004001f00000008000600", @ANYRES32=r6, @ANYBLOB="54000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b00000024000400020001c10100000008008028090000002000f80000800000008005800100000040000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r7, @ANYBLOB="08000700000000003c00010024000100656e61626c65640000000000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r8, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000300000008000600", @ANYRES32=r9, @ANYBLOB="40000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004004000000008000600", @ANYRES32=r10, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c000000000000000000000008000300030000000800040085c4426a08000100", @ANYRES32=r11, @ANYBLOB="3c00020038000100240001006e6f746966795f70656572735f696e74657276616c00000000000000000000000800030003000000080004000500000008000100", @ANYRES32=r12, @ANYBLOB="340202003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r13, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004000101000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b000000080004007f00000008000700000000003c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000000c000400686173680000000038000100240001006d636173745f72656a6f696e5f636f756e74000000000000000000000000000008000300030000000800040000000000400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000400000008000600", @ANYRES32=r14, @ANYBLOB="40000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b00000008000400ff01000008000600", @ANYRES32=r15, @ANYBLOB="4c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000001c0004000000000400000000020001b00000008001010908020000003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r16, @ANYBLOB="08000100", @ANYRES32=r17, @ANYBLOB="380102003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r18, @ANYBLOB="38000100240001006c625f73746174735f726566726573685f696e74657276616c00000000000000080003000300000008000400010000004c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000001c000400686173685f746f5f706f72745f6d617070696e67000000003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r19, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004000500000008000100", @ANYRES32=r20, @ANYBLOB="540102003c00010024000100757365725f6c696e6b75705f656e61626c65640000000000000000000000000008000300060000000400040008000600", @ANYRES32=r21, @ANYBLOB="64000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b000000340004000500010207000000050001042000000009000400020000000100096e7ab400000900ff6c810000003f0003ff0100000038000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000080003000300000008000400ffffffff38000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000080003000300000008000400422e4508400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000900000008000600", @ANYRES32=r22, @ANYBLOB="08000100", @ANYRES32=r23, @ANYBLOB="6c01020038000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000080003000300000008000400d9000000400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000800000008000600", @ANYRES32=r24, @ANYBLOB="3800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r25, @ANYBLOB="38000100240001006e6f746966795f70656572735f636f756e74000000000000000000000000000008000300030000000800040009000000400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004000400000008000600", @ANYRES32=r26, @ANYBLOB="40000100240001006c625f74785f686173685f746f5f706f72745f6d617070696e67000000000000080003000300000008000400", @ANYRES32=r27, @ANYBLOB="080007000000000008000100", @ANYRES32=r28, @ANYBLOB="fc0002003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r29, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f636f756e740000000000000000000000000000080003000300000008000400f8ffffff38000100240001006d636173745f72656a6f696e5f696e74657276616c000000000000000000000008000300030000000800040000c60b004c000100240001006c625f74785f6d6574686f64000000000000000000000000000000000000000008000300050000001c000400686173685f746f5f706f72745f6d617070696e670000000008000100", @ANYRES32=r30, @ANYBLOB="ac010200400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004008100000008000600", @ANYRES32=r31, @ANYBLOB="38000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004000400000040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004000b09000008000600", @ANYRES32=r32, @ANYBLOB="38000100240001006e6f746966795f70656572735f696e74657276616c00000000ef6b487fce1fc77b00000000000000080003000300000008000400ab0000006c000100240001006270665f686173685f66756e6300a638be448447d990a448ed89ed0000000000000000000000000000000000080003000b0000003c000400070009041f0000020d0005090500000004000800ffffff7fffff050100000100fbff08f7cf000000000881070600000053000700060000004c000100240001006c625f74785f6d6574686f640000000000000000000000000000008f0000000008000300050000001c000400686173685f746f5f700072745f6d617070696e67000000000800010000429e1cefe67488", @ANYRES32=r33, @ANYBLOB="bc00020040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b00000008000400ffffff7f08000600", @ANYRES32=r34, @ANYBLOB="3800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r35, @ANYBLOB="40000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b00000008000400f50000000800070000000000"], 0xc6c}, 0x1, 0x0, 0x0, 0x20000080}, 0x20000041)
bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0)
ioctl$EVIOCGBITSW(r3, 0x80404525, &(0x7f0000000240)=""/114)
unshare(0x40000000)
ioctl$VIDIOC_SUBDEV_G_FRAME_INTERVAL(r3, 0xc0305615, &(0x7f00000000c0)={0x0, {0x1}})
syz_open_dev$loop(0x0, 0x100000001, 0x0)

14:04:18 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}, 0x2c)

14:04:18 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7501]})

[ 1769.188604] binder: 14309:14317 unknown command 0
14:04:18 executing program 5:
r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc\x00', 0x0, 0x0)
setsockopt$inet6_tcp_buf(r0, 0x6, 0x3f, &(0x7f0000000040)="aef96f2200caf7d430fbbe43b8dfcf1d2cbe1541e4c619505ccdc9fb476d8739168e578252d9fe03790169c7a6c59cb0ad6ac656e5e1a60c79d70b0b92c00d64e3b9325e15308d4e3c889fae9b5251308e6d1de6f014dd21c774f01e49ba3e49672412a50c8449128e3551", 0x6b)
ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000000)={0x0, 0x20})

14:04:18 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x2c)

[ 1769.225684] binder: 14309:14317 ioctl c0306201 20000100 returned -22
[ 1769.282119] binder_alloc: binder_alloc_mmap_handler: 14309 20005000-20009000 already mapped failed -16
14:04:18 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7601]})

14:04:18 executing program 5:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000100)="0adc1f023c123f3188a070")
openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mISDNtimer\x00', 0x0, 0x0)
membarrier(0x2, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cpuset.effective_cpus\x00', 0x0, 0x0)
write$P9_RWALK(r1, &(0x7f0000000080)={0x16, 0x6f, 0x1, {0x1, [{0x11, 0x2, 0x5}]}}, 0x16)

14:04:18 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}, 0x2c)

[ 1769.362252] binder: BINDER_SET_CONTEXT_MGR already set
[ 1769.389132] binder: 14309:14326 ioctl 40046207 0 returned -16
[ 1769.447675] binder: release 14309:14317 transaction 636 out, still active
[ 1769.479899] binder: undelivered TRANSACTION_COMPLETE
14:04:18 executing program 5:
setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000001000)={0x10000, 0x4, 0x100, 0x400}, 0x10)
r0 = socket(0x11, 0x3, 0x0)
setsockopt$packet_int(r0, 0x107, 0xa, &(0x7f0000000040)=0x1, 0x4)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}, 0x11010, 0x0, 0x0, 0xfffffffffffffffe}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
semget(0xffffffffffffffff, 0x0, 0x100)
r1 = socket$pppoe(0x18, 0x1, 0x0)
r2 = accept(0xffffffffffffffff, 0x0, 0x0)
connect$pppoe(r1, &(0x7f0000000000)={0x18, 0x0, {0x2000000000002, @local, 'bridge0\x00'}}, 0x1e)
pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file0\x00')
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080))
sendmmsg(r1, &(0x7f000000d180), 0x4000000000000eb, 0x0)
shmget(0xffffffffffffffff, 0x4000, 0x0, &(0x7f0000ffb000/0x4000)=nil)
bind$packet(r2, &(0x7f0000000480)={0x11, 0x1, 0x0, 0x1, 0x0, 0x6, @local}, 0x14)
setsockopt(r0, 0x107, 0x5, &(0x7f0000001000), 0xc5)
setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, 0x0, 0x0)

14:04:18 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x2c)

14:04:18 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x630d}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1769.529020] binder: send failed reply for transaction 636, target dead
[ 1769.537939] IPVS: ftp: loaded support on port[0] = 21
[ 1769.552262] binder: send failed reply for transaction 637 to 14318:14320
[ 1769.682190] binder: 14344:14351 unknown command 0
14:04:18 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0xfffffffffffffec0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="106100000000008008440000"], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1769.716877] binder: 14344:14351 ioctl c0306201 20000100 returned -22
[ 1769.831539] binder: release 14344:14345 transaction 642 out, still active
[ 1769.844462] binder: undelivered TRANSACTION_COMPLETE
[ 1769.887769] binder: send failed reply for transaction 642, target dead
[ 1770.026205] IPVS: ftp: loaded support on port[0] = 21
14:04:19 executing program 3:
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
clone(0x84007ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = getpid()
mknod(&(0x7f0000000300)='./file0\x00', 0x10001040, 0x0)
execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0)
r2 = gettid()
clock_gettime(0x0, &(0x7f0000000180)={<r3=>0x0, <r4=>0x0})
rt_sigtimedwait(&(0x7f0000000040)={0x5}, &(0x7f0000000100), &(0x7f00000001c0)={r3, r4+10000000}, 0x8)
kcmp(r1, r2, 0x4, 0xffffffffffffffff, 0xffffffffffffffff)
timer_create(0x0, &(0x7f0000000500)={0x0, 0x12}, &(0x7f0000044000))
timer_settime(0x0, 0x0, &(0x7f00000000c0)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
tkill(r2, 0x1000000000016)
tkill(r1, 0xf)

14:04:19 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}, 0x2c)

14:04:19 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7702]})

14:04:19 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40046302}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:19 executing program 5:
r0 = socket$inet6(0xa, 0x6, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r1 = userfaultfd(0x0)
ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000002000))
ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000013000/0x2000)=nil, 0x2000}, 0x1})
setsockopt$inet_mreqsrc(r0, 0x10d, 0x11, &(0x7f0000013ff4)={@broadcast, @loopback}, 0xc)
close(r0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000380)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r2, 0x8912, 0x400200)
dup3(r0, r1, 0x0)
open(&(0x7f0000000000)='./file0\x00', 0x2, 0x2)

14:04:19 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}, 0x2c)

[ 1770.166130] binder: BC_ACQUIRE_RESULT not supported
[ 1770.182535] binder: 14370:14373 ioctl c0306201 20000100 returned -22
[ 1770.228596] binder_alloc: binder_alloc_mmap_handler: 14370 20005000-20009000 already mapped failed -16
14:04:19 executing program 5:
r0 = epoll_create(0x5)
socketpair(0xa, 0x80001, 0x9, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r3 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x2}, 0x22)
clock_gettime(0x0, &(0x7f00000000c0)={<r4=>0x0})
setsockopt$sock_timeval(r3, 0x1, 0x1d, &(0x7f0000000040)={r4}, 0x10)

[ 1770.268833] binder: BINDER_SET_CONTEXT_MGR already set
[ 1770.277500] binder: 14370:14382 ioctl 40046207 0 returned -16
[ 1770.278884] binder: BC_ACQUIRE_RESULT not supported
[ 1770.293253] binder_alloc: 14370: binder_alloc_buf, no vma
14:04:19 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9]}, 0x2c)

14:04:19 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7900]})

[ 1770.319103] binder: 14370:14388 ioctl c0306201 20000100 returned -22
[ 1770.335718] binder: release 14370:14373 transaction 645 out, still active
[ 1770.346904] binder: send failed reply for transaction 645, target dead
14:04:19 executing program 3:
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000000)={<r0=>0xffffffffffffffff})
connect$unix(r0, &(0x7f0000000200)=@abs={0x1, 0x0, 0x4e20}, 0x6e)
r1 = syz_open_dev$dspn(&(0x7f0000000040)='/dev/dsp#\x00', 0x808, 0x40)
ioctl$sock_bt_hidp_HIDPGETCONNLIST(r1, 0x800448d2, &(0x7f00000001c0)={0x2, &(0x7f0000000080)=[{}, {}]})
keyctl$KEYCTL_PKEY_SIGN(0x2, 0x0, 0x0, &(0x7f00000002c0), 0x0)

14:04:19 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}, 0x2c)

[ 1770.584883] binder: 14358:14361 Acquire 1 refcount change on invalid ref 0 ret -22
14:04:19 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x800)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x2000000, 0x10, 0xffffffffffffffff, 0x3)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
fallocate(r0, 0x6, 0xbb, 0x1)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000000c0)={0x8, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="9fdda7d75307b7056f4f068cf6000044fb7c161717be7e12af7c30fdd4980c3193360e1a33d2536f31db4497ccf81be0b220eabca680ff99732abdc3b8b9461842be59790c0bae17c164322560296e38dd9e058452e36ad788e2f3eea037b6bc1088d120edc96cd351ddc072680ca528e31ffed4319e931f394b698e0a9822d2fd159799e5ba4f2dd309d0c5a2650666c772099b3fb2cd9db6d8e7342540b931b30f390041e238ad48dd194e34bb84927406cf058a538775a1c6e5a16fe776a8c086d058dbba009930ac174d"], 0x5, 0x0, &(0x7f0000000080)="2cbf39e4ee"})

14:04:19 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40046304}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:19 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7a01]})

14:04:19 executing program 3:
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
clone(0x2102001ffa, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000280)={@in6={{0xa, 0x0, 0x0, @loopback}}, 0x0, 0x5, 0x0, "e5962022b4d8616459411fabfb18fa815190fed36ae16ad93a0a03f11a7fa6e490f3f569d54322814262fd287928b10ed4dc615dd020c5a2228d0c75ea98cd797612c033bc2c3b88fef6317fbc00ab1e"}, 0xd8)
connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1a)
r2 = syz_open_dev$dmmidi(&(0x7f0000000080)='/dev/dmmidi#\x00', 0x101, 0x102)
ioctl$KVM_IRQ_LINE(r2, 0x4008ae61, &(0x7f00000000c0)={0x40, 0x3})
r3 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x8040, 0x0)
setsockopt$inet_group_source_req(r0, 0x0, 0x2f, &(0x7f0000000140)={0xb7b, {{0x2, 0x4e22, @loopback}}, {{0x2, 0x4e23, @rand_addr=0x200}}}, 0x108)
getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r3, 0x84, 0x1f, &(0x7f0000000380)={<r4=>0x0, @in={{0x2, 0x4e23, @remote}}, 0x5ad, 0x6}, &(0x7f0000000440)=0x90)
getsockopt$inet_sctp6_SCTP_ASSOCINFO(r3, 0x84, 0x1, &(0x7f0000000480)={r4, 0x7fff, 0x1, 0x7, 0x9, 0x8}, &(0x7f00000004c0)=0x14)
ioctl$VIDIOC_S_CTRL(r3, 0xc008561c, &(0x7f0000000040)={0x5, 0x569})

14:04:19 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb]}, 0x2c)

14:04:19 executing program 5:
r0 = epoll_create(0x5)
socketpair(0xa, 0x80001, 0x9, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r3 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x2}, 0x22)
clock_gettime(0x0, &(0x7f00000000c0)={<r4=>0x0})
setsockopt$sock_timeval(r3, 0x1, 0x1d, &(0x7f0000000040)={r4}, 0x10)

[ 1770.772087] binder: 14429:14433 unknown command -676864609
[ 1770.796385] binder: 14429:14433 ioctl c0306201 200000c0 returned -22
14:04:19 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc]}, 0x2c)

[ 1770.819229] binder: release 14429:14433 transaction 650 out, still active
[ 1770.833427] binder: release 14429:14433 transaction 651 out, still active
14:04:19 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0x0, 0x800000000802)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
r2 = syz_open_dev$adsp(&(0x7f0000000140)='/dev/adsp#\x00', 0x9, 0x400040)
getsockopt$SO_COOKIE(r2, 0x1, 0x39, &(0x7f0000000200), &(0x7f0000000240)=0x8)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000280)={0x8, 0x0, &(0x7f00000002c0)=[@acquire], 0xc3, 0x0, &(0x7f0000000480)="ea685980b977480364cd3188918920677013cfa3aeda44998993a12b059f852b1c610dc6ddd1f7115ed1850dba11cf7468ab84a44ffdb8715271fc30f91aaeb8c9a796fd0abf59577d94ac4ee73b141c7e9831f5127e3ac2ddbf396ce8f6fa7f7cce74837e562477655bd0399c0d1d0f1f1ef97aeea1b8e26e39cdfc11fdde981d89e13d9c75355784ab8c014e81f0e40f363ae21e06a9170d3eb8575bdb390cbcbf47a239e0d7b9d414fe3eb56044be0024854466f20ebb0f06c2b604f2a814c7721d"})
fsetxattr(r0, &(0x7f0000000080)=@known='com.apple.FinderInfo\x00', &(0x7f00000000c0)='/dev/binder#\x00', 0xd, 0x2)

14:04:19 executing program 5:
r0 = epoll_create(0x5)
socketpair(0xa, 0x80001, 0x9, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r3 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x2}, 0x22)
clock_gettime(0x0, &(0x7f00000000c0)={<r4=>0x0})
setsockopt$sock_timeval(r3, 0x1, 0x1d, &(0x7f0000000040)={r4}, 0x10)

14:04:19 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7b01]})

14:04:20 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, 0x2c)

[ 1770.974585] binder: BINDER_SET_CONTEXT_MGR already set
[ 1771.009947] binder: 14444:14445 ioctl 40046207 0 returned -16
14:04:20 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}, 0x2c)

[ 1771.087476] binder: BINDER_SET_CONTEXT_MGR already set
[ 1771.118869] binder: 14444:14459 ioctl 40046207 0 returned -16
14:04:20 executing program 5:
r0 = epoll_create(0x5)
socketpair(0xa, 0x80001, 0x9, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r3 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x2}, 0x22)
clock_gettime(0x0, &(0x7f00000000c0)={<r4=>0x0})
setsockopt$sock_timeval(r3, 0x1, 0x1d, &(0x7f0000000040)={r4}, 0x10)

[ 1771.149109] binder: release 14444:14445 transaction 652 out, still active
[ 1771.158781] binder: release 14444:14445 transaction 654 out, still active
[ 1771.546345] binder_alloc: binder_alloc_mmap_handler: 14423 20005000-20009000 already mapped failed -16
[ 1771.556423] binder: BINDER_SET_CONTEXT_MGR already set
[ 1771.563017] binder: 14423:14478 ioctl 40046207 0 returned -16
[ 1771.569193] binder: 14477 RLIMIT_NICE not set
[ 1771.569225] binder_alloc: 14423: binder_alloc_buf, no vma
[ 1771.587056] binder: send failed reply for transaction 648 to 14423:14428
[ 1771.594364] binder: send failed reply for transaction 650, target dead
[ 1771.598233] binder_transaction: 4 callbacks suppressed
[ 1771.598247] binder: 14423:14476 transaction failed 29189/-3, size 0-0 line 3035
[ 1771.609503] binder: send failed reply for transaction 651, target dead
[ 1771.629584] binder: send failed reply for transaction 652, target dead
[ 1771.636370] binder_release_work: 5 callbacks suppressed
[ 1771.636375] binder: undelivered TRANSACTION_COMPLETE
[ 1771.647703] binder_release_work: 8 callbacks suppressed
[ 1771.647709] binder: undelivered TRANSACTION_ERROR: 29189
14:04:20 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40046307}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:20 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f04]})

14:04:20 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0x0, 0x42)
r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x0, 0x0)
ioctl$VIDIOC_S_EXT_CTRLS(r1, 0xc0205648, &(0x7f0000000140)={0xa30000, 0x200, 0x9, [], &(0x7f00000000c0)={0x0, 0x1, [], @value64=0x8728000000000}})
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:20 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf]}, 0x2c)

14:04:20 executing program 5:
r0 = epoll_create(0x5)
socketpair(0xa, 0x80001, 0x9, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r3 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x2}, 0x22)
clock_gettime(0x0, &(0x7f00000000c0))

14:04:20 executing program 3:
r0 = socket$inet(0x2, 0x1, 0x0)
r1 = dup2(r0, r0)
ioctl$SG_SET_DEBUG(r1, 0x227e, &(0x7f0000000000))
io_setup(0x5, &(0x7f0000000040)=<r2=>0x0)
setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, 0x0, 0x0)
setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, 0x0, 0x0)
bind$packet(0xffffffffffffffff, 0x0, 0x0)
lremovexattr(0x0, &(0x7f00000004c0)=ANY=[])
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getresuid(0x0, &(0x7f0000000240), &(0x7f0000000280))
r3 = socket$inet6(0xa, 0x3, 0x3c)
connect$inet6(r3, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c)
write$binfmt_script(r3, &(0x7f0000002ec0)=ANY=[@ANYBLOB='!0\n'], 0x3)
ioctl$VIDIOC_G_OUTPUT(r1, 0x8004562e, &(0x7f0000000100))
r4 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_fanout(r4, 0x107, 0x12, &(0x7f0000000000), 0x4)
msgsnd(0x0, &(0x7f0000001b80), 0x8, 0x0)
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
setsockopt(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000001000), 0xc5)
syz_emit_ethernet(0x66, &(0x7f0000000140)={@empty=[0x2b], @link_local, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @local, @local}, @gre={{0x0, 0x0, 0x1, 0x0, 0x3}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x57}}}}}}, 0x0)
io_getevents(r2, 0x4, 0x2, &(0x7f0000000080)=[{}, {}], 0x0)
connect$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @broadcast}, 0x10)

[ 1771.695552] binder: undelivered TRANSACTION_ERROR: 29189
[ 1771.790136] binder: 14483:14487 transaction failed 29189/-22, size 0-0 line 2896
14:04:20 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10]}, 0x2c)

[ 1771.832220] binder: 14492:14494 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 1771.844362] binder: undelivered TRANSACTION_ERROR: 29189
[ 1771.852837] binder: undelivered TRANSACTION_COMPLETE
[ 1771.869538] protocol 88fb is buggy, dev hsr_slave_0
[ 1771.874621] protocol 88fb is buggy, dev hsr_slave_1
14:04:20 executing program 0:
r0 = syz_open_dev$audion(&(0x7f0000000080)='/dev/audio#\x00', 0x3, 0x82)
fcntl$setpipe(r0, 0x407, 0x8)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x2000000, 0x40000010, r1, 0x3)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})
ioctl$TCSBRKP(r0, 0x5425, 0x3ff)

[ 1771.879781] protocol 88fb is buggy, dev hsr_slave_0
[ 1771.884841] protocol 88fb is buggy, dev hsr_slave_1
14:04:20 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8004]})

14:04:21 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11]}, 0x2c)

14:04:21 executing program 5:
r0 = epoll_create(0x5)
socketpair(0xa, 0x80001, 0x9, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
r3 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x2}, 0x22)

14:04:21 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12]}, 0x2c)

[ 1772.602359] binder_alloc: binder_alloc_mmap_handler: 14492 20005000-20009000 already mapped failed -16
[ 1772.612328] binder: BINDER_SET_CONTEXT_MGR already set
[ 1772.617622] binder: 14492:14530 ioctl 40046207 0 returned -16
[ 1772.624020] binder: 14492:14529 DecRefs 0 refcount change on invalid ref 0 ret -22
[ 1772.624046] binder_alloc: 14492: binder_alloc_buf, no vma
[ 1772.632073] binder: 14529 RLIMIT_NICE not set
[ 1772.642615] binder_thread_release: 1 callbacks suppressed
[ 1772.642625] binder: release 14492:14494 transaction 659 out, still active
[ 1772.656283] binder: undelivered TRANSACTION_COMPLETE
[ 1772.661532] binder_send_failed_reply: 1 callbacks suppressed
[ 1772.661538] binder: send failed reply for transaction 659, target dead
[ 1772.674359] binder: send failed reply for transaction 661, target dead
[ 1772.675434] binder: 14492:14527 transaction failed 29189/-3, size 0-0 line 3035
[ 1772.681344] binder: send failed reply for transaction 663 to 14504:14506
14:04:21 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40046312}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:21 executing program 5:
r0 = epoll_create(0x5)
socketpair(0xa, 0x80001, 0x9, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")
socket$inet6(0xa, 0x2, 0x0)

14:04:21 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
open(&(0x7f0000000180)='./file0\x00', 0x40, 0x1)
clone(0x2102001ffc, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
execve(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)

14:04:21 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8005]})

14:04:21 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13]}, 0x2c)

14:04:21 executing program 3:
perf_event_open(&(0x7f0000000140)={0x2, 0x70, 0x3e7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
io_setup(0x2, &(0x7f0000000080)=<r0=>0x0)
io_submit(r0, 0x1, &(0x7f0000000540)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0}])
openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x0, 0x0)
syz_open_dev$video(&(0x7f0000000040)='/dev/video#\x00', 0xfffffffffffffbff, 0x1)

[ 1772.701000] binder: 14504:14506 transaction failed 29189/-22, size 0-0 line 2896
[ 1772.702350] binder: undelivered TRANSACTION_ERROR: 29189
[ 1772.726536] binder: 14504:14510 Acquire 1 refcount change on invalid ref 0 ret -22
14:04:21 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14]}, 0x2c)

[ 1772.841208] binder: undelivered TRANSACTION_ERROR: 29189
[ 1772.861268] binder: 14545:14546 unknown command 1074029330
14:04:21 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="056304400000000089c19ff2509e47b30b931d40ddd04b0491655006dbb309ba8319e304cafb6980c03c9ab93c7a045591b7d4eac006f1417cf4526f91a12c34d16ef7f82aec229ff4e8e18c55e1f2a72f01ebbf3fa0a413166e3b6ae6422508fd15561ce9454a160c21b725db567677fb33e01e603ead98ecddfe7ac013d5407fd7e6ce5a7b1d2ff14fb020e0ffc7542a383a8e4b6cf804b1f9d987f72b251a8b"], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:21 executing program 5:
r0 = epoll_create(0x5)
socketpair(0xa, 0x80001, 0x9, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1)
r2 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r2, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")

[ 1772.892778] binder: 14545:14546 ioctl c0306201 20000100 returned -22
[ 1772.924820] binder_alloc: binder_alloc_mmap_handler: 14545 20005000-20009000 already mapped failed -16
[ 1772.954710] binder: BINDER_SET_CONTEXT_MGR already set
14:04:22 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8501]})

14:04:22 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x15]}, 0x2c)

[ 1772.988771] binder: 14545:14555 ioctl 40046207 0 returned -16
[ 1773.011114] binder_alloc: 14545: binder_alloc_buf, no vma
14:04:22 executing program 3:
syz_extract_tcp_res(&(0x7f0000000040), 0x40, 0x6f)
syz_extract_tcp_res$synack(&(0x7f00000000c0), 0x1, 0x0)
syz_emit_ethernet(0x56, &(0x7f0000000180)={@link_local, @random="2135cc49b50b", [], {@canfd={0xd, {{0x2, 0x8, 0x20, 0x2}, 0x40, 0x0, 0x0, 0x0, "2e094d5d72f3ac9023ef0c55c5271aba901fe05c62092ecd843ea90073db63e1ffc939678e90d5dde2fd9060c6d5e7311c1430d77d0a3007822a7e89c5ee06f5"}}}}, 0x0)
r0 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x111000, 0x0)
write$P9_RFLUSH(r0, &(0x7f0000000080)={0x7, 0x6d, 0x2}, 0x7)

[ 1773.056838] binder: release 14545:14546 transaction 668 out, still active
[ 1773.070633] binder: 14561:14562 transaction failed 29189/-3, size 0-0 line 3035
[ 1773.085048] binder: undelivered TRANSACTION_COMPLETE
14:04:22 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40086303}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:22 executing program 5:
r0 = epoll_create(0x5)
socketpair(0xa, 0x80001, 0x9, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1)
socket$inet_udplite(0x2, 0x2, 0x88)

[ 1773.103696] binder: send failed reply for transaction 668, target dead
[ 1773.118396] binder: 14561:14570 Acquire 1 refcount change on invalid ref 0 ret -22
14:04:22 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18]}, 0x2c)

[ 1773.181139] binder: 14561:14562 transaction failed 29189/-22, size 0-0 line 2896
[ 1773.236426] binder: 14579:14580 BC_FREE_BUFFER u0000630c00000000 no match
[ 1773.256558] binder: undelivered TRANSACTION_ERROR: 29189
[ 1773.275349] binder: undelivered TRANSACTION_ERROR: 29189
14:04:22 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0x0, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:22 executing program 3:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fcntl$setlease(0xffffffffffffffff, 0x400, 0x1)
setxattr$trusted_overlay_origin(&(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='trusted.overlay.origin\x00', &(0x7f0000000180)='y\x00', 0x2, 0x0)
connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c)
ioctl$sock_kcm_SIOCKCMCLONE(r1, 0x89e2, &(0x7f0000000880)={<r2=>r0})
getsockname$inet(r2, &(0x7f00000008c0), &(0x7f0000000900)=0x10)
sendmmsg(r0, &(0x7f0000000140), 0x0, 0x0)
r3 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080)='/dev/nullb0\x00', 0x4000000004002, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r3, 0x40082406, &(0x7f0000000140)='GPLcpuset-]:]nodevlotrustedmime_type.vboxnet1wlan0\x00')
write$binfmt_elf64(0xffffffffffffffff, 0x0, 0x0)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r4, 0x0)
sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40242}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x48000}, 0x814)
setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f00000001c0)=ANY=[@ANYBLOB="0646b3c0cbd588f92001772fd7c70c01aa8398ede55d3b3d1b94365840c2266ceb4d6f229bf4a34b2a35952b77111a6239720d776623cb3ee661f225e69201adf395578aebbbc41ae2e0fba15a4c2013578c6ee553a108aaa71d73562039b4182cb63f30bb7e49abace452f1f595b094a1e8949bec6dda6ae09e25fb7c37106c344fda515057712de0db0a7c1c7257ce4e3e70f2f41d31139d6433e8d8efa02ba2e1ed7ff173cc0877b49ca20bf149b5edef4abe"], 0x1)
write$binfmt_misc(r4, &(0x7f0000000440)={'syz1'}, 0x1200e)

14:04:22 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}, 0x2c)

14:04:22 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8601]})

14:04:22 executing program 5:
r0 = epoll_create(0x5)
socketpair(0xa, 0x80001, 0x9, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1)
socket$inet_udplite(0x2, 0x2, 0x88)

14:04:22 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500]}, 0x2c)

14:04:22 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8701]})

14:04:22 executing program 3:
socket$inet_udp(0x2, 0x2, 0x0)
r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r2, 0x0)
sendto$inet6(r1, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r1, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)
ioctl$KVM_ARM_SET_DEVICE_ADDR(r0, 0x4010aeab, &(0x7f0000000140)={0x81, 0x1f004})
sendto$inet6(0xffffffffffffffff, &(0x7f0000000300), 0xfd90, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
add_key$keyring(&(0x7f0000000400)='keyring\x00', &(0x7f0000000440)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb)

14:04:22 executing program 5:
r0 = epoll_create(0x5)
socketpair(0xa, 0x80001, 0x9, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1)
socket$inet_udplite(0x2, 0x2, 0x88)

[ 1773.709610] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
[ 1774.030897] binder_alloc: binder_alloc_mmap_handler: 14579 20005000-20009000 already mapped failed -16
[ 1774.040554] binder: BINDER_SET_CONTEXT_MGR already set
[ 1774.045850] binder: 14579:14632 ioctl 40046207 0 returned -16
[ 1774.052557] binder: 14579:14631 BC_FREE_BUFFER u0000630c00000000 no match
[ 1774.059976] binder_alloc: 14579: binder_alloc_buf, no vma
[ 1774.065578] binder: 14579:14630 transaction failed 29189/-3, size 0-0 line 3035
[ 1774.073944] binder: send failed reply for transaction 672 to 14579:14580
14:04:23 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x4008630a}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:04:23 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600]}, 0x2c)

14:04:23 executing program 5:
r0 = epoll_create(0x5)
socketpair(0xa, 0x80001, 0x9, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1)
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")

[ 1774.081948] binder: send failed reply for transaction 673 to 14590:14591
[ 1774.089011] binder: undelivered TRANSACTION_COMPLETE
[ 1774.094876] binder: undelivered TRANSACTION_ERROR: 29189
[ 1774.101035] binder: 14590:14591 transaction failed 29189/-22, size 0-0 line 2896
[ 1774.109737] binder: undelivered TRANSACTION_ERROR: 29189
14:04:23 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:04:23 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8705]})

14:04:23 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700]}, 0x2c)

[ 1774.160640] binder: BC_ATTEMPT_ACQUIRE not supported
[ 1774.176099] binder: 14640:14641 ioctl c0306201 20000100 returned -22
[ 1774.210741] binder_alloc: binder_alloc_mmap_handler: 14640 20005000-20009000 already mapped failed -16
[ 1774.251992] binder: BINDER_SET_CONTEXT_MGR already set
14:04:23 executing program 5:
r0 = epoll_create(0x5)
socketpair(0xa, 0x80001, 0x9, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1)
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")

14:04:23 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900]}, 0x2c)

[ 1774.286622] binder: 14640:14645 ioctl 40046207 0 returned -16
[ 1774.337488] binder: BC_ATTEMPT_ACQUIRE not supported
14:04:23 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00639c7a000000000000000000000000fc00000002000000ffffffffffffffdf000000000000000000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="60f35bd964eb23dba3eedc04bd563e1f15339fe549812b7211eb0902000000000000009b6df0e0a67f4e947a5ccb0b43a5a06ab3d59abef8dfc2d306e6f79d9c5ba4a9ab21a90086b1be039416bf9bec2c2378065f706b0fc04600e06d82772997b780339841fd2e805ca712da7f34ddb4cf6b84eeec4948b39bbedf64e08171275c219a83372986270c814191b056cf43aee42a89abfd23ff82af790e2cd1a86d2bca25f51251d2a03c19d40a2e95046a14357e513e66f77755544095a7e629"], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1774.380612] binder_alloc: 14640: binder_alloc_buf, no vma
[ 1774.404556] binder: release 14640:14641 transaction 678 out, still active
[ 1774.411955] binder: 14640:14641 ioctl c0306201 20000100 returned -22
[ 1774.423609] binder: undelivered TRANSACTION_COMPLETE
14:04:23 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00]}, 0x2c)

[ 1774.425268] binder: 14640:14659 transaction failed 29189/-3, size 0-0 line 3035
[ 1774.448227] binder: send failed reply for transaction 678, target dead
[ 1774.494842] binder: undelivered TRANSACTION_ERROR: 29189
[ 1774.501553] binder: 14666:14668 unknown command 2057069312
[ 1774.517508] binder: 14666:14668 ioctl c0306201 20000440 returned -22
[ 1774.541219] binder: 14666:14668 unknown command -648285344
[ 1774.556489] binder: 14666:14668 ioctl c0306201 20000100 returned -22
[ 1774.589222] binder: 14666:14674 unknown command 2057069312
[ 1774.592033] binder: 14666:14676 unknown command -648285344
[ 1774.600732] binder: 14666:14676 ioctl c0306201 20000100 returned -22
[ 1774.606713] binder: 14666:14674 ioctl c0306201 20000440 returned -22
14:05:22 executing program 3:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ppp\x00', 0x0, 0x0)
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$EVIOCGPROP(r0, 0xc004743e, &(0x7f00000002c0)=""/246)
ioctl$PPPIOCSFLAGS(r0, 0x40047459, &(0x7f0000000000))

14:05:22 executing program 5:
r0 = epoll_create(0x5)
socketpair(0xa, 0x80001, 0x9, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
epoll_ctl$EPOLL_CTL_DEL(r0, 0x2, r1)
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")

14:05:22 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8b00]})

14:05:22 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c)

14:05:22 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40086310}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:22 executing program 0:
r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vga_arbiter\x00', 0x4000, 0x0)
ioctl$sock_inet_SIOCDELRT(r0, 0x890c, &(0x7f0000000200)={0x0, {0x2, 0x4e24, @rand_addr=0xffffffff}, {0x2, 0x4e23, @multicast1}, {0x2, 0x4e24, @remote}, 0x22, 0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)='rose0\x00', 0x8000, 0x1, 0x7})
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:05:23 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00]}, 0x2c)

[ 1833.982735] binder: 14682:14683 BC_DEAD_BINDER_DONE 0000630c00000000 not found
14:05:23 executing program 5:
epoll_create(0x5)
socketpair(0xa, 0x80001, 0x9, &(0x7f0000000080))
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")

14:05:23 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00]}, 0x2c)

14:05:23 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900d]})

14:05:23 executing program 5:
socketpair(0xa, 0x80001, 0x9, &(0x7f0000000080))
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")

14:05:23 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}, 0x2c)

[ 1834.752494] binder_alloc: binder_alloc_mmap_handler: 14682 20005000-20009000 already mapped failed -16
[ 1834.753071] binder: BINDER_SET_CONTEXT_MGR already set
[ 1834.768218] binder: 14682:14722 ioctl 40046207 0 returned -16
[ 1834.770208] binder_alloc: 14682: binder_alloc_buf, no vma
[ 1834.775373] binder: 14682:14722 BC_DEAD_BINDER_DONE 0000630c00000000 not found
[ 1834.787692] binder: send failed reply for transaction 682 to 14682:14683
[ 1834.794502] binder: 14684:14723 transaction failed 29189/-3, size 0-0 line 3035
[ 1834.802024] binder: send failed reply for transaction 683 to 14684:14685
[ 1834.802358] binder: 14684:14724 Acquire 1 refcount change on invalid ref 0 ret -22
[ 1834.816595] binder: undelivered TRANSACTION_COMPLETE
[ 1834.822254] binder: undelivered TRANSACTION_ERROR: 29189
[ 1834.828022] binder_alloc: 14682: binder_alloc_buf, no vma
[ 1834.834820] binder: 14682:14721 transaction failed 29189/-3, size 0-0 line 3035
[ 1834.842473] binder: undelivered TRANSACTION_ERROR: 29189
[ 1834.864140] binder: undelivered TRANSACTION_ERROR: 29189
[ 1835.774541] IPVS: ftp: loaded support on port[0] = 21
[ 1835.835629] chnl_net:caif_netlink_parms(): no params data found
[ 1835.863666] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1835.870252] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1835.877086] device bridge_slave_0 entered promiscuous mode
[ 1835.884387] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1835.890967] bridge0: port 2(bridge_slave_1) entered disabled state
[ 1835.897911] device bridge_slave_1 entered promiscuous mode
[ 1835.912989] bond0: Enslaving bond_slave_0 as an active interface with an up link
[ 1835.921921] bond0: Enslaving bond_slave_1 as an active interface with an up link
[ 1835.939413] team0: Port device team_slave_0 added
[ 1835.946017] team0: Port device team_slave_1 added
[ 1836.002277] device hsr_slave_0 entered promiscuous mode
[ 1836.043713] device hsr_slave_1 entered promiscuous mode
[ 1836.110660] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1836.117153] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 1836.123853] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1836.130325] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 1836.167621] 8021q: adding VLAN 0 to HW filter on device bond0
[ 1836.179265] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 1836.187777] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1836.205774] bridge0: port 2(bridge_slave_1) entered disabled state
[ 1836.213666] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 1836.225793] 8021q: adding VLAN 0 to HW filter on device team0
[ 1836.235297] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 1836.243429] bridge0: port 1(bridge_slave_0) entered blocking state
[ 1836.249856] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 1836.261617] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 1836.269300] bridge0: port 2(bridge_slave_1) entered blocking state
[ 1836.275702] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 1836.294004] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 1836.303788] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 1836.314678] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 1836.329428] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 1836.339756] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 1836.351291] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 1836.358923] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 1836.366755] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 1836.383715] 8021q: adding VLAN 0 to HW filter on device batadv0
14:05:25 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x2, 0x7, 0x0, 0x0, 0x2}, 0x10}}, 0x0)

14:05:25 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9104]})

14:05:25 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00]}, 0x2c)

14:05:25 executing program 5:
socketpair(0x0, 0x80001, 0x9, &(0x7f0000000080))
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")

14:05:25 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x400c630e}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:25 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0563044000000004"], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1836.514670] binder: 14740:14741 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1836.521101] binder: BINDER_SET_CONTEXT_MGR already set
[ 1836.529706] binder: 14746:14747 ioctl 40046207 0 returned -16
14:05:25 executing program 5:
socketpair(0x0, 0x80001, 0x9, &(0x7f0000000080))
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")

14:05:25 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1100]}, 0x2c)

[ 1836.555993] binder: 14746:14747 Acquire 1 refcount change on invalid ref 67108864 ret -22
14:05:25 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9e00]})

14:05:25 executing program 5:
socketpair(0x0, 0x80001, 0x9, &(0x7f0000000080))
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")

14:05:25 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1200]}, 0x2c)

14:05:25 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1300]}, 0x2c)

14:05:26 executing program 3:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r0, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x2, 0x7, 0x0, 0x0, 0x2}, 0x10}}, 0x0)

14:05:26 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa001]})

14:05:26 executing program 5:
socketpair(0x0, 0x0, 0x9, &(0x7f0000000080))
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")

14:05:26 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1400]}, 0x2c)

[ 1837.308887] binder: BINDER_SET_CONTEXT_MGR already set
[ 1837.331104] binder_alloc: binder_alloc_mmap_handler: 14740 20005000-20009000 already mapped failed -16
[ 1837.344205] binder: BINDER_SET_CONTEXT_MGR already set
[ 1837.349902] binder: 14740:14826 ioctl 40046207 0 returned -16
[ 1837.357180] binder: 14746:14829 ioctl 40046207 0 returned -16
[ 1837.390647] binder_alloc: 14740: binder_alloc_buf, no vma
[ 1837.408026] binder: 14746:14828 transaction failed 29189/-3, size 0-0 line 3035
[ 1837.415192] binder: 14740:14826 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
[ 1837.438459] binder: release 14746:14747 transaction 689 out, still active
[ 1837.448071] binder: undelivered TRANSACTION_ERROR: 29189
[ 1837.481158] binder: release 14740:14741 transaction 688 out, still active
[ 1837.488652] binder_alloc: 14740: binder_alloc_buf, no vma
[ 1837.509650] binder: undelivered TRANSACTION_COMPLETE
[ 1837.509695] binder: 14740:14836 transaction failed 29189/-3, size 0-0 line 3035
[ 1837.514882] binder: send failed reply for transaction 688, target dead
[ 1837.541675] binder: send failed reply for transaction 689, target dead
14:05:26 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x400c630f}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:26 executing program 5:
socketpair(0x0, 0x0, 0x9, &(0x7f0000000080))
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")

14:05:26 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1500]}, 0x2c)

14:05:26 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00d]})

14:05:26 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r1, &(0x7f0000f56000)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000333f88)={0x2, 0x4, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_sa={0x2}]}, 0x38}}, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1837.590546] binder: undelivered TRANSACTION_ERROR: 29189
14:05:26 executing program 3:
r0 = socket(0x10, 0x2, 0xc)
write(r0, 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200)
close(r0)

14:05:26 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1800]}, 0x2c)

[ 1837.662255] binder: 14849:14855 transaction failed 29189/-22, size 0-0 line 2896
[ 1837.710110] binder: 14851:14853 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
[ 1837.740887] binder: undelivered TRANSACTION_ERROR: 29189
14:05:26 executing program 3:
clone(0x3102001ffe, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff)
r0 = gettid()
wait4(0x0, 0x0, 0x80000000, 0x0)
ptrace$setopts(0x4206, r0, 0x0, 0x0)
tkill(r0, 0x1b)
ptrace$cont(0x18, r0, 0x0, 0x0)
ptrace$setregs(0xd, r0, 0x0, &(0x7f0000000080))
ptrace$cont(0x21, r0, 0x0, 0x0)

14:05:26 executing program 5:
socketpair(0x0, 0x0, 0x0, &(0x7f0000000080))
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")

14:05:26 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00]}, 0x2c)

[ 1837.790945] binder: release 14849:14855 transaction 696 out, still active
[ 1837.806853] binder: undelivered TRANSACTION_COMPLETE
14:05:26 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc000]})

14:05:26 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$mouse(&(0x7f00000000c0)='/dev/input/mouse#\x00', 0x7, 0x121000)
openat$cgroup_ro(r1, &(0x7f00000003c0)='cpuacct.usage_percpu\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r2 = mmap$binder(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x1000004, 0x10, r0, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000080)={r2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})
r3 = getpgid(0x0)
process_vm_readv(r3, &(0x7f00000002c0)=[{&(0x7f0000000200)=""/51, 0x33}, {&(0x7f0000000240)=""/30, 0x1e}, {&(0x7f00000005c0)=""/4096, 0x1000}, {&(0x7f0000000280)}], 0x4, &(0x7f0000000380)=[{&(0x7f0000000480)=""/247, 0xf7}, {&(0x7f00000015c0)=""/4096, 0x1000}], 0x2, 0x0)

[ 1837.901799] ptrace attach of "/root/syz-executor.3"[14871] was attempted by "/root/syz-executor.3"[14872]
[ 1838.445749] binder: BINDER_SET_CONTEXT_MGR already set
[ 1838.451407] binder_alloc: binder_alloc_mmap_handler: 14851 20005000-20009000 already mapped failed -16
[ 1838.451999] binder: 14851:14888 ioctl 40046207 0 returned -16
[ 1838.467247] binder_alloc: 14851: binder_alloc_buf, no vma
[ 1838.473497] binder: 14851:14888 BC_CLEAR_DEATH_NOTIFICATION invalid ref 0
[ 1838.475097] binder: 14851:14887 transaction failed 29189/-3, size 0-0 line 3035
[ 1838.481265] binder: release 14851:14853 transaction 694 out, still active
14:05:27 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40106308}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:27 executing program 3:
r0 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x15, 0x0, 0x0)

14:05:27 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000]}, 0x2c)

14:05:27 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")

14:05:27 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc100]})

[ 1838.496246] binder: undelivered TRANSACTION_COMPLETE
[ 1838.502039] binder: undelivered TRANSACTION_ERROR: 29189
[ 1838.507766] binder: send failed reply for transaction 694, target dead
[ 1838.518014] binder: send failed reply for transaction 696, target dead
[ 1838.525178] binder: send failed reply for transaction 698 to 14880:14881
[ 1838.542276] binder: 14880:14883 Acquire 1 refcount change on invalid ref 0 ret -22
[ 1838.579953] binder: 14880:14881 transaction failed 29189/-22, size 0-0 line 2896
14:05:27 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")

14:05:27 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000]}, 0x2c)

14:05:27 executing program 3:
socket$kcm(0x10, 0x5, 0x10)
r0 = socket$kcm(0xa, 0x6, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x0)
getpid()
socketpair(0x0, 0x0, 0x8, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x20000400000037, 0x0, 0xffffffffffffffff}, 0x2c)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
r1 = socket$kcm(0xa, 0x2, 0x73)
sendmsg$kcm(r1, &(0x7f00000003c0)={&(0x7f0000000000)=@nl=@unspec, 0x80, 0x0}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuacct.usage_sys\x00', 0x0, 0x0)
r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup/syz1\x00', 0x200002, 0x0)
openat$cgroup_ro(r0, &(0x7f0000000340)='pids.events\x00', 0x0, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='rdma.current\x00', 0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000c00)='syz0\x00', 0x200002, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000c40)='memory.swap.current\x00', 0x0, 0x0)
r4 = openat$cgroup_ro(r2, &(0x7f00000004c0)='\x00\x82\x19hm\xaf\xd6\x1eq\xa1\xae\x9asB\x19\xcdN\t?\xba^|\x9f@Z\xe2\x0f\xbc \xa2/Bi\x0e\x84\xadU(\x0eh\x97\x18H,\x96\xa0&\x02E\t\xa5q\xdc\xcf\x1b\xcf\x895\xa2\xf8Y\xf5\x99\xc4\x11A\x8dX\xf0\xebb\x93\v\xa9\xb3\xe9\x06\xc4\xa7G\xcbZ\x14\xc7~\x98\x93\xdb\x1b\xf0\xd7\xe7x\xebs\x970\xc2\xf8j\x80:\x1b\xfe=\xd1H\xe1\x04\xecQ\xe8o\x8e(\x87\xb9\x1da\xcaI\x19\xc4%3\x9d\xcb}\xa0m\'\x02A$[\xe8v\r+4\x11Nq\x88\xb1\xa8,\xf2\x1d\xa2}\x82\xcdgf\n\xab\xf5?C\x9eQ\x8b\x87\x1f\xb9b_\xd7\x89\xde\xe3\xf4\a\x1eR\xf6\x86\x99\x99\xb38\x0f \xbc2\t\xdd\x137)\x8f\xc7$\xc6\x1d/\x93\xb3\x06\xb8\x93<C\xbc\x94\xb7\x04W\xf2\x83\x1c\xb1', 0x0, 0x0)
ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x0)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000200)={r3, 0x488ca9744f0f948a, 0x0}, 0x4)
recvmsg(r0, 0x0, 0x0)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f00000000c0)=r1, 0x4)
ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='/dev/net/tun\x00', 0x0, 0x0)
r5 = openat$tun(0xffffffffffffff9c, 0x0, 0x400000, 0x0)
ioctl$TUNSETIFINDEX(r5, 0x400454da, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40004}, 0x4001)
socketpair(0x0, 0x0, 0x100000000000, &(0x7f0000000900))
ioctl$TUNSETTXFILTER(r3, 0x400454d1, &(0x7f0000000580)=ANY=[])
socketpair(0x9, 0x5, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x4, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00'})
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000440)='lo\x00\x96o\xd6Q\xb9Y\xa9dJ,\x00\xd2\x97\x04\x03\xdc\r')
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000680)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1\x81\x96\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xfa4\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')

14:05:27 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
getpeername(0xffffffffffffff9c, &(0x7f0000000080)=@pppol2tpin6={0x18, 0x1, {0x0, <r1=>0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, &(0x7f0000000140)=0x80)
ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000200)={'rose0\x00', 0xfffffffffffffffc})
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1838.625583] binder: 14899:14900 BC_INCREFS_DONE u0000630c00000000 no match
[ 1838.657314] binder: undelivered TRANSACTION_ERROR: 29189
14:05:27 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc200]})

14:05:27 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff]}, 0x2c)

14:05:27 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")

[ 1838.832245] device lo entered promiscuous mode
[ 1839.404177] binder_alloc: binder_alloc_mmap_handler: 14899 20005000-20009000 already mapped failed -16
[ 1839.419563] binder: BINDER_SET_CONTEXT_MGR already set
[ 1839.424990] binder: 14899:14933 ioctl 40046207 0 returned -16
[ 1839.439837] binder_alloc: 14899: binder_alloc_buf, no vma
[ 1839.449566] binder: 14899:14933 BC_INCREFS_DONE u0000630c00000000 no match
[ 1839.452471] binder: 14899:14932 transaction failed 29189/-3, size 0-0 line 3035
[ 1839.475272] binder: release 14899:14900 transaction 703 out, still active
[ 1839.487767] binder: undelivered TRANSACTION_COMPLETE
[ 1839.505340] binder: undelivered TRANSACTION_ERROR: 29189
[ 1839.527270] binder: send failed reply for transaction 703, target dead
14:05:28 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40106309}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:28 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]}, 0x2c)

14:05:28 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xce00]})

14:05:28 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")

[ 1839.553576] binder: 14912:14934 transaction failed 29189/-22, size 0-0 line 2896
[ 1839.553758] binder: send failed reply for transaction 704 to 14912:14913
14:05:28 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")

14:05:28 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]}, 0x2c)

[ 1839.679158] binder: 14944:14948 BC_ACQUIRE_DONE u0000630c00000000 no match
14:05:28 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd004]})

[ 1839.760330] binder: undelivered TRANSACTION_ERROR: 29189
14:05:28 executing program 3:
socket$kcm(0x10, 0x5, 0x10)
r0 = socket$kcm(0xa, 0x6, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x0)
getpid()
socketpair(0x0, 0x0, 0x8, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x20000400000037, 0x0, 0xffffffffffffffff}, 0x2c)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
r1 = socket$kcm(0xa, 0x2, 0x73)
sendmsg$kcm(r1, &(0x7f00000003c0)={&(0x7f0000000000)=@nl=@unspec, 0x80, 0x0}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuacct.usage_sys\x00', 0x0, 0x0)
r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup/syz1\x00', 0x200002, 0x0)
openat$cgroup_ro(r0, &(0x7f0000000340)='pids.events\x00', 0x0, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='rdma.current\x00', 0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000c00)='syz0\x00', 0x200002, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000c40)='memory.swap.current\x00', 0x0, 0x0)
r4 = openat$cgroup_ro(r2, &(0x7f00000004c0)='\x00\x82\x19hm\xaf\xd6\x1eq\xa1\xae\x9asB\x19\xcdN\t?\xba^|\x9f@Z\xe2\x0f\xbc \xa2/Bi\x0e\x84\xadU(\x0eh\x97\x18H,\x96\xa0&\x02E\t\xa5q\xdc\xcf\x1b\xcf\x895\xa2\xf8Y\xf5\x99\xc4\x11A\x8dX\xf0\xebb\x93\v\xa9\xb3\xe9\x06\xc4\xa7G\xcbZ\x14\xc7~\x98\x93\xdb\x1b\xf0\xd7\xe7x\xebs\x970\xc2\xf8j\x80:\x1b\xfe=\xd1H\xe1\x04\xecQ\xe8o\x8e(\x87\xb9\x1da\xcaI\x19\xc4%3\x9d\xcb}\xa0m\'\x02A$[\xe8v\r+4\x11Nq\x88\xb1\xa8,\xf2\x1d\xa2}\x82\xcdgf\n\xab\xf5?C\x9eQ\x8b\x87\x1f\xb9b_\xd7\x89\xde\xe3\xf4\a\x1eR\xf6\x86\x99\x99\xb38\x0f \xbc2\t\xdd\x137)\x8f\xc7$\xc6\x1d/\x93\xb3\x06\xb8\x93<C\xbc\x94\xb7\x04W\xf2\x83\x1c\xb1', 0x0, 0x0)
ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x0)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000200)={r3, 0x488ca9744f0f948a, 0x0}, 0x4)
recvmsg(r0, 0x0, 0x0)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f00000000c0)=r1, 0x4)
ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='/dev/net/tun\x00', 0x0, 0x0)
r5 = openat$tun(0xffffffffffffff9c, 0x0, 0x400000, 0x0)
ioctl$TUNSETIFINDEX(r5, 0x400454da, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40004}, 0x4001)
socketpair(0x0, 0x0, 0x100000000000, &(0x7f0000000900))
ioctl$TUNSETTXFILTER(r3, 0x400454d1, &(0x7f0000000580)=ANY=[])
socketpair(0x9, 0x5, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x4, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00'})
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000440)='lo\x00\x96o\xd6Q\xb9Y\xa9dJ,\x00\xd2\x97\x04\x03\xdc\r')
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000680)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1\x81\x96\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xfa4\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')

14:05:28 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(0xffffffffffffffff, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")

14:05:28 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000]}, 0x2c)

14:05:28 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$swradio(&(0x7f0000000200)='/dev/swradio#\x00', 0x0, 0x2)
setsockopt$inet_tcp_TLS_TX(r1, 0x6, 0x1, &(0x7f0000000240), 0x4)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20\x00', 0x200000, 0x0)
setsockopt$inet6_tcp_TLS_TX(r2, 0x6, 0x1, &(0x7f0000000140), 0x4)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="8072d6289be36346e18837010001004b22630aab693373b48aafa944925bb71c807d70d49d896410c44a89ea08e8cfbcdd2373584d2053d5fe43197200eb7d121a2ee285088aa72ce94afc6202d87d1bfe9c6247d207a58f263ad2a729d4b8af7ebfee825c5557048ba6228e01efab9cb3783c9d"], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1839.877393] binder: 14963:14964 unknown command 685142656
[ 1839.899682] binder: 14963:14964 ioctl c0306201 20000100 returned -22
14:05:28 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f3188b070")

[ 1839.929942] binder: 14963:14969 unknown command 685142656
[ 1839.953003] binder: 14963:14969 ioctl c0306201 20000100 returned -22
[ 1840.003154] binder: release 14963:14964 transaction 710 out, still active
[ 1840.017365] binder: undelivered TRANSACTION_COMPLETE
[ 1840.041292] binder: release 14963:14968 transaction 711 out, still active
[ 1840.075219] binder: undelivered TRANSACTION_COMPLETE
[ 1840.432941] binder: BINDER_SET_CONTEXT_MGR already set
[ 1840.438400] binder: 14944:14979 ioctl 40046207 0 returned -16
[ 1840.438434] binder_alloc: binder_alloc_mmap_handler: 14944 20005000-20009000 already mapped failed -16
[ 1840.454134] binder_alloc: 14944: binder_alloc_buf, no vma
[ 1840.454940] binder: 14944:14980 BC_ACQUIRE_DONE u0000630c00000000 no match
[ 1840.467339] binder: send failed reply for transaction 709 to 14944:14948
[ 1840.474458] binder: 14944:14979 transaction failed 29189/-3, size 0-0 line 3035
[ 1840.475152] binder: send failed reply for transaction 710, target dead
[ 1840.488688] binder: send failed reply for transaction 711, target dead
[ 1840.495555] binder: undelivered TRANSACTION_COMPLETE
[ 1840.500729] binder: undelivered TRANSACTION_ERROR: 29189
14:05:29 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406300}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:29 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000]}, 0x2c)

14:05:29 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd901]})

14:05:29 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f3188b070")

14:05:29 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x2000000000000000)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$midi(&(0x7f0000000140)='/dev/midi#\x00', 0x1f, 0x200000)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
r2 = syz_open_dev$midi(&(0x7f0000000080)='/dev/midi#\x00', 0x800, 0x100)
write$P9_RWALK(r2, &(0x7f00000000c0)={0x3d, 0x6f, 0x1, {0x4, [{0x4, 0x4, 0x6}, {0x20, 0x4, 0x5}, {0x10, 0x0, 0x2}, {0x10, 0x0, 0x3}]}}, 0x3d)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:05:29 executing program 3:
socket$kcm(0x10, 0x5, 0x10)
r0 = socket$kcm(0xa, 0x6, 0x0)
perf_event_open(&(0x7f0000000180)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TUNSETLINK(0xffffffffffffffff, 0x400454cd, 0x0)
getpid()
socketpair(0x0, 0x0, 0x8, 0x0)
bpf$MAP_CREATE(0x0, &(0x7f0000000000)={0x20000400000037, 0x0, 0xffffffffffffffff}, 0x2c)
ioctl$PERF_EVENT_IOC_ENABLE(0xffffffffffffffff, 0x8912, 0x400200)
r1 = socket$kcm(0xa, 0x2, 0x73)
sendmsg$kcm(r1, &(0x7f00000003c0)={&(0x7f0000000000)=@nl=@unspec, 0x80, 0x0}, 0x0)
openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='cpuacct.usage_sys\x00', 0x0, 0x0)
r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000002c0)='./cgroup/syz1\x00', 0x200002, 0x0)
openat$cgroup_ro(r0, &(0x7f0000000340)='pids.events\x00', 0x0, 0x0)
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='rdma.current\x00', 0x0, 0x0)
openat$cgroup(0xffffffffffffffff, &(0x7f0000000c00)='syz0\x00', 0x200002, 0x0)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000c40)='memory.swap.current\x00', 0x0, 0x0)
r4 = openat$cgroup_ro(r2, &(0x7f00000004c0)='\x00\x82\x19hm\xaf\xd6\x1eq\xa1\xae\x9asB\x19\xcdN\t?\xba^|\x9f@Z\xe2\x0f\xbc \xa2/Bi\x0e\x84\xadU(\x0eh\x97\x18H,\x96\xa0&\x02E\t\xa5q\xdc\xcf\x1b\xcf\x895\xa2\xf8Y\xf5\x99\xc4\x11A\x8dX\xf0\xebb\x93\v\xa9\xb3\xe9\x06\xc4\xa7G\xcbZ\x14\xc7~\x98\x93\xdb\x1b\xf0\xd7\xe7x\xebs\x970\xc2\xf8j\x80:\x1b\xfe=\xd1H\xe1\x04\xecQ\xe8o\x8e(\x87\xb9\x1da\xcaI\x19\xc4%3\x9d\xcb}\xa0m\'\x02A$[\xe8v\r+4\x11Nq\x88\xb1\xa8,\xf2\x1d\xa2}\x82\xcdgf\n\xab\xf5?C\x9eQ\x8b\x87\x1f\xb9b_\xd7\x89\xde\xe3\xf4\a\x1eR\xf6\x86\x99\x99\xb38\x0f \xbc2\t\xdd\x137)\x8f\xc7$\xc6\x1d/\x93\xb3\x06\xb8\x93<C\xbc\x94\xb7\x04W\xf2\x83\x1c\xb1', 0x0, 0x0)
ioctl$TUNSETPERSIST(r4, 0x400454cb, 0x0)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000200)={r3, 0x488ca9744f0f948a, 0x0}, 0x4)
recvmsg(r0, 0x0, 0x0)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, &(0x7f00000000c0)=r1, 0x4)
ioctl$PERF_EVENT_IOC_SET_FILTER(0xffffffffffffffff, 0x40082406, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000240)='/dev/net/tun\x00', 0x0, 0x0)
r5 = openat$tun(0xffffffffffffff9c, 0x0, 0x400000, 0x0)
ioctl$TUNSETIFINDEX(r5, 0x400454da, 0x0)
sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40004}, 0x4001)
socketpair(0x0, 0x0, 0x100000000000, &(0x7f0000000900))
ioctl$TUNSETTXFILTER(r3, 0x400454d1, &(0x7f0000000580)=ANY=[])
socketpair(0x9, 0x5, 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000480)='/dev/net/tun\x00', 0x4, 0x0)
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00'})
socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r6=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000440)='lo\x00\x96o\xd6Q\xb9Y\xa9dJ,\x00\xd2\x97\x04\x03\xdc\r')
ioctl$PERF_EVENT_IOC_SET_FILTER(r6, 0x8914, &(0x7f0000000680)='lo\x00\x96o8\x0fd\xa1\xe3\xd7]b}\x1f\xa1Y\xad4\x90\x9d`\xd2\x98\x00\x00\x00 \'Y\x17]\x15c\xcaR\xdd\x98OC\x89\x1b\xe7\x84\xe2\x05\x80w\xd2|D\x8dK\x14Bx\xcbuH\xc2\xeec\xbf<>Y\x1a\xfc\x1f9OB\x81\x89\x186\xc5q@n\xb4\xb6s\xb0\x00\x00\x00\x00\x00\b\x00\x00\xda\xef\xecE\xec\xd5I\xb2\x9b\xfe\x8d\x90?\x00\xe9\xe4~g:\xc1\xb2aj\x96\xbb\xa7\xe2\xc0\xdc\xf9Q\b\xeb\x16\x7fT\x11\xd3\r7\xe6\"f\xcf\x8e\xabd\x0ftp\x82\xae\xd2\x15\x8e+c\xf6\xbf\xe14>\xa6-\xa5c\xde\xd7\xab\xea\x1f\xf8s2\x9cVF\xd5\x18\xfe\x0e\x8f \x01\x00\x00y.\xfc*\x82\xa5\xa1p5\xc8{\xf7\xef\xab\xe8\x99\xebw#\x8at\x1c\x80\xfc\xb0\x95\xa2\xa7\xd7,Y]E8\x83X\xf5F\xdc\x88-\xf5\xb0\xb5^\xdb\x1a\xb6\xaa\x14\xe2\xb9\rh^J-\xd1\xbaUn\x04\'l\x1b\xe0o\xdb\xc8\x91%\x1c\xb5\xbf\xb6\x90\xb4\xc2\x7f]/\xb3\xe7\xc9\'\x94\xcfIo\xdf\x04\x95\xb5\x06\x84\x1fH>\xda\xc5\x04 \x94\x88\xeb\'\xd4;6\x7f\xd9\x99-\x1b|G\x8d\xd4\xb9%\xaaQ\xa0K\x10\x03\x93\xe1\xcc\xe7m\x80\'\xf0\xa5\xed(\r\xa8\x0f&\xb1\xf3\xff0\f\x82%_\x92\x8bD\xb9\xd9\xe7\xf2\xe4\xc1i#\xdc\x87A\xb9\xc7\r\x92\xfa\x11\x11\xb5\x1f\x03\x9d\xdd\x1bj\xdf\xacg\xe3\xa0S\xd3\x8a\xe1n\x97\xea\xf5\xa0\'\v\xe9\xa0\xf1 f\xaan\xcf\xb5i\xb6d\xbc\x92\v\xd58\x16\b\xb3_:\xa4!\ny\xc4&\nWMM\xa8\xc4\v\x9f\x01o\xf4\xab&\xb6\x17\x02P\xc3!N\xa1\x86\"\xd7\x04\xf1\xc0!\xed\xff\xee$\xc89\x8cB0\xd1dD\xe0IP\x88\xa2\xf2Y\x9af$$\xf1\x81\x96\xf7P\xac\xca\x80:!\xb4\x94#\xcb^\x9f\'\x03\xe3\x93\xb9\x82\xbf\xcf\xc4\xe3\xf7\x03Oh\xf2r\xca\x8ff\xbb/\x9f*\xaf\x1a \xa5\xa0?%M\xa5\x86\x98\xfa4\'1\xc7\f<\xcc@\xe8\x8a\xac.\xde\xe4\xc7\xf5\x9ck\xa40!\xe9\x14$\xb3\x05m\xb5m\xed\ft\x93\xd8\xa3\x80\'Y\xb9\x05\xbbt|\xbe\xbcz\n\xf3\xf5p\xf8\x9f~\x1b\xd0\v\x1cQ')

[ 1840.559725] binder: undelivered TRANSACTION_ERROR: 29189
[ 1840.605344] binder: 14983:14991 Acquire 1 refcount change on invalid ref 0 ret -22
14:05:29 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x0, &(0x7f0000000000)="0adc1f123c123f3188b070")

14:05:29 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5000000]}, 0x2c)

[ 1840.679853] binder: 14992:14996 got new transaction with bad transaction stack, transaction 714 has target 14992:0
14:05:29 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/sys/net/ipv4/vs/pmtu_disc\x00', 0x2, 0x0)
setsockopt$RDS_CANCEL_SENT_TO(r1, 0x114, 0x1, &(0x7f0000000200)={0x2, 0x4e24, @broadcast}, 0x10)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$SNDRV_TIMER_IOCTL_STATUS(r1, 0x80605414, &(0x7f0000000240)=""/186)
pipe2(&(0x7f0000000080)={0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x80800)
ioctl$SIOCGETNODEID(r2, 0x89e1, &(0x7f00000000c0))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:05:29 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe006]})

[ 1840.757459] binder: 14992:14996 transaction failed 29201/-71, size 0-0 line 2946
14:05:29 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, 0x0)

[ 1840.832698] binder: BINDER_SET_CONTEXT_MGR already set
14:05:29 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6000000]}, 0x2c)

[ 1840.853480] binder_alloc: binder_alloc_mmap_handler: 14992 20005000-20009000 already mapped failed -16
[ 1840.921988] binder: 14992:15008 ioctl 40046207 0 returned -16
[ 1840.922838] binder_alloc: 14992: binder_alloc_buf, no vma
[ 1840.997703] binder: send failed reply for transaction 714 to 14992:14996
[ 1841.017715] binder: undelivered TRANSACTION_COMPLETE
[ 1841.020666] binder_alloc: 14992: binder_alloc_buf, no vma
[ 1841.028658] binder: 14992:15020 transaction failed 29189/-3, size 0-0 line 3035
[ 1841.028720] binder_alloc: 14992: binder_alloc_buf, no vma
[ 1841.037579] binder: 15009:15010 Acquire 1 refcount change on invalid ref 0 ret -22
[ 1841.056707] binder: undelivered TRANSACTION_ERROR: 29201
[ 1841.087496] binder: 15009:15015 transaction failed 29189/-3, size 0-0 line 3035
[ 1841.093657] binder: undelivered TRANSACTION_ERROR: 29189
[ 1841.101123] binder: 14992:15019 transaction failed 29189/-3, size 0-0 line 3035
[ 1841.115278] binder: 15009:15015 transaction failed 29189/-22, size 0-0 line 2896
14:05:30 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:30 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, 0x0)

14:05:30 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff02]})

14:05:30 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7000000]}, 0x2c)

[ 1841.141907] binder: undelivered TRANSACTION_ERROR: 29189
[ 1841.147446] binder: undelivered TRANSACTION_ERROR: 29189
[ 1841.149667] binder: 15009:15010 Acquire 1 refcount change on invalid ref 0 ret -22
[ 1841.196052] binder: undelivered TRANSACTION_ERROR: 29189
14:05:30 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, 0x0)

[ 1841.304352] binder: 15034:15036 got reply transaction with bad transaction stack, transaction 721 has target 15034:0
[ 1841.321299] binder: undelivered TRANSACTION_ERROR: 29189
[ 1841.369799] binder: 15034:15036 transaction failed 29201/-71, size 0-0 line 2816
[ 1841.411741] binder_alloc: binder_alloc_mmap_handler: 15034 20005000-20009000 already mapped failed -16
[ 1841.420495] binder: BINDER_SET_CONTEXT_MGR already set
[ 1841.466340] binder: 15034:15042 ioctl 40046207 0 returned -16
[ 1841.479764] binder: 15034:15046 got reply transaction with no transaction stack
[ 1841.487378] binder: 15034:15046 transaction failed 29201/-71, size 0-0 line 2801
[ 1841.489820] binder_alloc: 15034: binder_alloc_buf, no vma
[ 1841.509889] binder: 15034:15045 transaction failed 29189/-3, size 0-0 line 3035
[ 1841.517635] binder: release 15034:15036 transaction 721 out, still active
[ 1841.533818] binder: undelivered TRANSACTION_COMPLETE
[ 1841.538993] binder: undelivered TRANSACTION_ERROR: 29201
[ 1841.548317] binder: send failed reply for transaction 721, target dead
[ 1841.620210] binder: undelivered TRANSACTION_ERROR: 29189
14:05:30 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:30 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000]}, 0x2c)

14:05:30 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$dspn(&(0x7f0000000080)='/dev/dsp#\x00', 0x200, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffff9c, 0x8933, &(0x7f00000000c0)={'team0\x00', <r2=>0x0})
setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000140)={r2, 0x1, 0x6, @broadcast}, 0x10)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:05:30 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff0b]})

14:05:30 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000))

14:05:30 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40486311}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:30 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000))

[ 1841.746713] binder: 15056:15057 got new transaction with bad transaction stack, transaction 726 has target 15056:0
[ 1841.770489] binder: BINDER_SET_CONTEXT_MGR already set
[ 1841.788482] binder: 15049:15059 ioctl 40046207 0 returned -16
14:05:30 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9000000]}, 0x2c)

[ 1841.798336] binder: 15049:15059 got reply transaction with bad transaction stack, transaction 730 has target 15056:0
[ 1841.829692] binder: 15049:15059 transaction failed 29201/-71, size 0-0 line 2816
[ 1841.861130] binder: BINDER_SET_CONTEXT_MGR already set
14:05:30 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa000000]}, 0x2c)

14:05:30 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10040]})

14:05:30 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000))

[ 1841.903294] binder_alloc: binder_alloc_mmap_handler: 15056 20005000-20009000 already mapped failed -16
[ 1841.908431] binder: 15056:15063 ioctl 40046207 0 returned -16
[ 1841.925770] binder: release 15049:15059 transaction 730 out, still active
[ 1841.942370] binder: undelivered TRANSACTION_COMPLETE
[ 1841.974285] binder_alloc: 15056: binder_alloc_buf, no vma
[ 1842.002935] binder_alloc: 15056: binder_alloc_buf, no vma
14:05:31 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1842.021756] binder: send failed reply for transaction 726 to 15056:15057
[ 1842.034814] binder: send failed reply for transaction 728 to 15050:15051
14:05:31 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb000000]}, 0x2c)

14:05:31 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12")

[ 1842.072226] binder: send failed reply for transaction 730, target dead
[ 1842.079129] binder: undelivered TRANSACTION_COMPLETE
[ 1842.106923] binder: 15079:15080 got reply transaction with bad transaction stack, transaction 736 has target 15079:0
14:05:31 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xfffffffffffffe44, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:05:31 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40486312}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:31 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc000000]}, 0x2c)

14:05:31 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100c0]})

14:05:31 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12")

[ 1842.263083] binder: release 15079:15080 transaction 736 out, still active
[ 1842.271424] binder: 15089:15090 ioctl c0306201 20000440 returned -14
[ 1842.282676] binder: BINDER_SET_CONTEXT_MGR already set
[ 1842.299195] binder: undelivered TRANSACTION_COMPLETE
14:05:31 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1842.320964] binder: 15092:15095 ioctl 40046207 0 returned -16
[ 1842.337823] binder: send failed reply for transaction 736, target dead
[ 1842.358063] binder: send failed reply for transaction 738 to 15089:15090
14:05:31 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd000000]}, 0x2c)

[ 1842.360060] binder: 15092:15095 got reply transaction with no transaction stack
[ 1842.373102] binder: 15089:15103 Acquire 1 refcount change on invalid ref 0 ret -22
[ 1842.373158] binder: 15089:15090 ioctl c0306201 20000440 returned -14
14:05:31 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c12")

[ 1842.427672] binder_alloc: binder_alloc_mmap_handler: 15092 20005000-20009000 already mapped failed -16
[ 1842.440991] binder: 15105:15106 got reply transaction with bad transaction stack, transaction 744 has target 15105:0
[ 1842.476068] binder: BINDER_SET_CONTEXT_MGR already set
14:05:31 executing program 0:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
fdatasync(r0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:05:31 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000]})

[ 1842.507329] binder: 15092:15107 ioctl 40046207 0 returned -16
14:05:31 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe000000]}, 0x2c)

14:05:31 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188")

[ 1842.589650] binder: release 15105:15106 transaction 744 out, still active
[ 1842.596685] binder: undelivered TRANSACTION_COMPLETE
14:05:31 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40046305, 0x3f00}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:31 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1842.663434] binder: send failed reply for transaction 744, target dead
[ 1842.677085] binder: send failed reply for transaction 746 to 15117:15118
14:05:31 executing program 0:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000100)=<r2=>0x0)
r3 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000140)='/dev/ubi_ctrl\x00', 0x2840, 0x0)
ioctl$VIDIOC_DBG_G_REGISTER(r3, 0xc0385650, &(0x7f00000002c0)={{}, 0x8, 0xe940})
perf_event_open(&(0x7f0000000000)={0x5, 0x70, 0x1, 0x6, 0x8, 0x9, 0x0, 0x906b, 0x0, 0xc, 0x6, 0x3, 0x8, 0x1, 0x3637, 0x5623639b, 0x2, 0x1e, 0x6, 0x1e, 0x0, 0x0, 0x5, 0x5, 0x94, 0x9, 0x6, 0x1000, 0x2, 0x7, 0x7, 0x19, 0x8, 0x400, 0xa6, 0x0, 0x0, 0x48febce9, 0x0, 0x80, 0x0, @perf_config_ext={0x6}, 0x8180, 0x7, 0x3888d30, 0xd, 0x6, 0x0, 0x277}, r2, 0xf, r0, 0x2)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a40c9aaa0ef3a32fea6d125cf46a00f7809f79a79c0e1b8807b6c42e2b9f5aa0a54f8380ceba5505b7206ac36a22646762e49c48def17729207b21a71516fcff7651e8c93c"], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000), 0xc8, 0x0, &(0x7f0000000080)="bc"})

[ 1842.732889] binder: 15127:15129 Acquire 1 refcount change on invalid ref 16128 ret -22
[ 1842.737798] binder: BINDER_SET_CONTEXT_MGR already set
14:05:31 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188")

14:05:31 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000]})

[ 1842.774658] binder: 15130:15133 ioctl 40046207 0 returned -16
[ 1842.801286] binder: 15130:15137 got reply transaction with no transaction stack
14:05:31 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf000000]}, 0x2c)

[ 1842.832395] binder: BINDER_SET_CONTEXT_MGR already set
[ 1842.847910] binder: 15136:15142 ioctl 40046207 0 returned -16
14:05:31 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:31 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188")

14:05:31 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000]}, 0x2c)

14:05:32 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000]})

[ 1843.012263] binder: BINDER_SET_CONTEXT_MGR already set
14:05:32 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b0")

[ 1843.036095] binder: 15151:15153 ioctl 40046207 0 returned -16
[ 1843.060091] binder: 15151:15161 got reply transaction with no transaction stack
14:05:32 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11000000]}, 0x2c)

[ 1843.498009] binder_alloc: binder_alloc_mmap_handler: 15127 20005000-20009000 already mapped failed -16
[ 1843.503637] binder: BINDER_SET_CONTEXT_MGR already set
[ 1843.512997] binder: 15127:15173 ioctl 40046207 0 returned -16
[ 1843.519060] binder: 15127:15173 Acquire 1 refcount change on invalid ref 16128 ret -22
[ 1843.519105] binder_alloc: 15127: binder_alloc_buf, no vma
[ 1843.527488] binder: 15173 RLIMIT_NICE not set
[ 1843.527834] binder: release 15127:15129 transaction 750 out, still active
14:05:32 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40046305, 0x1000000}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:32 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1843.545261] binder: undelivered TRANSACTION_COMPLETE
[ 1843.550724] binder: send failed reply for transaction 750, target dead
[ 1843.557463] binder: send failed reply for transaction 752 to 15136:15148
[ 1843.588845] binder: 15174:15175 got reply transaction with no transaction stack
[ 1843.595976] binder: BINDER_SET_CONTEXT_MGR already set
[ 1843.604368] binder: 15136:15148 ioctl 40046207 0 returned -16
[ 1843.616637] binder: BINDER_SET_CONTEXT_MGR already set
[ 1843.626706] binder: 15177:15178 ioctl 40046207 0 returned -16
14:05:32 executing program 0:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
r1 = fcntl$dupfd(r0, 0x0, r0)
ioctl$BLKRRPART(r1, 0x125f, 0x0)
prctl$PR_GET_TIMERSLACK(0x1e)
r2 = getpgrp(0xffffffffffffffff)
r3 = syz_open_procfs(r2, &(0x7f0000000080)='status\x00')
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
modify_ldt$read_default(0x2, &(0x7f0000000580)=""/73, 0xfcf7)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
getsockopt$inet_sctp6_SCTP_INITMSG(r3, 0x84, 0x2, &(0x7f0000000000), &(0x7f0000000200)=0x8)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000200000000000000d62668477f264452a8150df1303442fc35599925ac20975625f6a9076b0c5934bfae1136bfe54296b0647648e75fd9813a212e424ad13fa76c770a085c24e80f1c74377b09b53998cf0094986700d160b24fc032e4a50715369de08c24421a0dd68cd15ebdb8240fcd971e54d338929dff6eb9676b4dc72049da009c1768"], 0x0, 0x0, 0x0})
ioctl$RTC_IRQP_READ(r3, 0x8008700b, &(0x7f00000000c0))
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="05630440000000000efe7e61b7f1331bbdac82622c808e50476a2e3adc63da145723b784bc48"], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:05:32 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b0")

14:05:32 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4d564b]})

14:05:32 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12000000]}, 0x2c)

14:05:32 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1843.634818] binder_alloc: 15174: binder_alloc_buf failed to map pages in userspace, no vma
[ 1843.644103] binder_alloc: 15174: binder_alloc_buf failed to map pages in userspace, no vma
[ 1843.660434] binder_alloc: binder_alloc_mmap_handler: 15177 20005000-20009000 already mapped failed -16
[ 1843.670297] binder_alloc: 15177: binder_alloc_buf, no vma
[ 1843.671596] binder: 15177:15181 Acquire 1 refcount change on invalid ref 16777216 ret -22
[ 1843.728867] binder: 15181 RLIMIT_NICE not set
14:05:32 executing program 5:
socketpair(0x0, 0x0, 0x0, 0x0)
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b0")

14:05:32 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13000000]}, 0x2c)

14:05:32 executing program 0:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$dmmidi(&(0x7f0000000680)='/dev/dmmidi#\x00', 0x3b84, 0x408000)
ioctl$TIOCMBIS(r1, 0x5416, &(0x7f00000006c0))
r2 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
fsetxattr$security_ima(r0, &(0x7f0000000300)='security.ima\x00', &(0x7f0000000640)=@ng={0x4, 0x4, "88196f5c25ef"}, 0x8, 0x2)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000140)={0x5c, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="10630840030000000000000010630840030000000000000000634040030000000000000004000000000000000000000000000000000000000000000000000000002ad8003800000000000000", @ANYPTR=&(0x7f0000000080)=ANY=[], @ANYPTR=&(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000300000000000000000000000000000001800000000000000680000000000000000000000000000003800000000000000"]], 0xa7, 0x0, &(0x7f0000000380)="5391e6a387f505371be7b2d4bfc52c0b146b654f28e031ef1a4fe7723e4037480aaee6764c6fd09a4cf6b5cc6dee93a74cb766bad0c896f0c7a356869f59986ee6e6c3e926d287ff4fc2a75e823e5ca0e9a9da7b1f3fc61e677d2899fa4c6f3d1141ed5de889b33549fe12be7883b8b65bc3a1f7ae417c038ddf12e32b4bfbcb424658a1cdc4b13f210465608221884603bdbec5dc7f621120b1037a81d5cd644fc6c2f906de4d"})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090b6cf452d69550332f6d2e7afa6ac53a57fbf3ee956b187e7d8c7f2d99aea89c888876c3c1ac6f94d4b7733baccf3c9ebdc0003f7497143a67995d1b8207d3948b7b5a7ab398e3d70d1e373c89f0819b624c29b6bd6632d83d6f6655c416afd31c4fc39928ae32a9c67a5055c5244586a026cb0caafa00cf09064053357a171094dfddf3d0b1eb08394ca023213b455f07932733d202e7d334fa2e0886563da8e0"], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})
pipe(&(0x7f0000000340)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
getsockopt$bt_rfcomm_RFCOMM_LM(r3, 0x12, 0x3, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
getsockopt$inet6_tcp_buf(r3, 0x6, 0x1f, &(0x7f0000000200)=""/71, &(0x7f0000000080)=0x47)

14:05:32 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40046305, 0x3f000000}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:32 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:32 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14000000]}, 0x2c)

14:05:32 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff]})

14:05:33 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40046305, 0x1000000}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1843.979323] binder: 15204:15207 BC_DEAD_BINDER_DONE 0000000000000003 not found
[ 1844.005143] binder: 15209:15210 Acquire 1 refcount change on invalid ref 1056964608 ret -22
14:05:33 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1844.019242] binder: 15205:15206 got reply transaction with bad transaction stack, transaction 764 has target 15209:0
[ 1844.030440] binder: BINDER_SET_CONTEXT_MGR already set
[ 1844.030462] binder: 15211:15213 ioctl 40046207 0 returned -16
[ 1844.031106] binder: 15211:15213 Acquire 1 refcount change on invalid ref 16777216 ret -22
[ 1844.050054] binder: 15204:15207 BC_DEAD_BINDER_DONE 0000000000000003 not found
[ 1844.055778] binder: release 15205:15206 transaction 764 out, still active
[ 1844.068111] binder: 15204:15207 got transaction to invalid handle
14:05:33 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x15000000]}, 0x2c)

14:05:33 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1844.108800] binder: 15219:15220 got reply transaction with bad transaction stack, transaction 770 has target 15209:0
[ 1844.123487] binder: release 15219:15220 transaction 770 out, still active
14:05:33 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000]})

14:05:33 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18000000]}, 0x2c)

[ 1844.188849] binder: 15223:15224 got reply transaction with bad transaction stack, transaction 772 has target 15209:0
[ 1844.216219] binder: release 15223:15224 transaction 772 out, still active
14:05:33 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1844.758457] binder: 15204:15238 BC_DEAD_BINDER_DONE 0000000000000003 not found
[ 1844.767682] binder: 15204:15238 BC_DEAD_BINDER_DONE 0000000000000003 not found
[ 1844.776016] binder: 15204:15238 got transaction to invalid handle
[ 1844.778645] binder_alloc: binder_alloc_mmap_handler: 15209 20005000-20009000 already mapped failed -16
[ 1844.782647] binder_alloc: 15209: binder_alloc_buf, no vma
[ 1844.802566] binder: release 15211:15213 transaction 766 out, still active
[ 1844.814448] binder: BINDER_SET_CONTEXT_MGR already set
[ 1844.820037] binder: 15209:15240 ioctl 40046207 0 returned -16
[ 1844.826658] binder: 15209:15241 Acquire 1 refcount change on invalid ref 1056964608 ret -22
[ 1844.852257] binder: release 15204:15216 transaction 767 out, still active
14:05:33 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x20000, 0x0)
ioctl$KVM_SET_XCRS(r1, 0x4188aea7, &(0x7f0000000200)={0x7, 0x400, [{0x0, 0x0, 0xb0}, {0x7, 0x0, 0xb64}, {0x4a1, 0x0, 0x81}, {0x7, 0x0, 0x100000001}, {0x0, 0x0, 0x3ff}, {0x5, 0x0, 0x4}, {0x20, 0x0, 0x9}]})
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x40000010, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1844.862593] binder: 15241 RLIMIT_NICE not set
[ 1844.872338] binder: send failed reply for transaction 763 to 15209:15210
[ 1844.879229] binder: send failed reply for transaction 764, target dead
[ 1844.893684] binder: send failed reply for transaction 766, target dead
[ 1844.901972] binder: send failed reply for transaction 767, target dead
[ 1844.908700] binder: send failed reply for transaction 770, target dead
[ 1844.924964] binder: send failed reply for transaction 772, target dead
14:05:33 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40046305, 0x100000000000000}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:33 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f000000]}, 0x2c)

14:05:33 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:33 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10100c0]})

14:05:33 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406300}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:34 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:05:34 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe4ffffff]}, 0x2c)

[ 1845.049651] binder: 15252:15260 got new transaction with bad transaction stack, transaction 781 has target 15252:0
[ 1845.062814] binder: BINDER_SET_CONTEXT_MGR already set
[ 1845.068147] binder: 15251:15261 ioctl 40046207 0 returned -16
14:05:34 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14d564b]})

14:05:34 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1845.130262] binder: 15261 RLIMIT_NICE not set
[ 1845.146206] binder: 15265:15266 unknown command 0
[ 1845.159841] binder: 15265:15266 ioctl c0306201 20000100 returned -22
14:05:34 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff8000]}, 0x2c)

14:05:34 executing program 5:
socketpair(0x0, 0x80001, 0x9, &(0x7f0000000080))
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")

[ 1845.191275] binder: release 15252:15260 transaction 781 out, still active
[ 1845.206473] binder_release_work: 7 callbacks suppressed
[ 1845.206478] binder: undelivered TRANSACTION_COMPLETE
[ 1845.219991] binder: BINDER_SET_CONTEXT_MGR already set
[ 1845.225340] binder: 15251:15268 ioctl 40046207 0 returned -16
[ 1845.242002] binder: release 15265:15266 transaction 785 out, still active
[ 1845.269499] binder: undelivered TRANSACTION_COMPLETE
[ 1845.274728] binder: send failed reply for transaction 781, target dead
[ 1845.286174] binder: 15261 RLIMIT_NICE not set
14:05:34 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000008d3d43313010e17409000000000000000000000000ef0000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0})
r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci\x00', 0x40000, 0x0)
ioctl$VIDIOC_G_FBUF(r1, 0x8030560a, &(0x7f00000000c0)={0x14, 0x8, &(0x7f0000000200)="c0eddaf69c1d9e5f6bc949cd81a633c4537a3027c986480be530a68d4cf16a362b549772c8f596ac86bd626d6ee468895e935f0a1eaf620730c07c059b4293beb7be1b52592e879c18f1078393c1e1a6fa2174b29a46f056e73776bb61586c289f1bb8e669c39dd98c3a78e8a640dc9165ce97f0616804afac93947eb9bc299edcb09621b29813a5ef70e7679bbad28b49fd", {0x1000, 0x7d, 0x4745504a, 0x6, 0x5, 0x8, 0x9, 0x6}})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})
ioctl$EVIOCGABS20(r1, 0x80184560, &(0x7f00000005c0)=""/4096)

[ 1845.322192] binder: send failed reply for transaction 783 to 15251:15268
[ 1845.338841] binder: send failed reply for transaction 785, target dead
[ 1845.365671] binder: undelivered TRANSACTION_COMPLETE
14:05:34 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40046305, 0x3f00000000000000}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:34 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:34 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffe4]}, 0x2c)

14:05:34 executing program 5:
socketpair(0x0, 0x80001, 0x9, &(0x7f0000000080))
r0 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070")

14:05:34 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000]})

[ 1845.488866] binder_transaction: 32 callbacks suppressed
[ 1845.488882] binder: 15291:15292 transaction failed 29189/-22, size 0-0 line 2896
[ 1845.529626] binder_release_work: 31 callbacks suppressed
[ 1845.529634] binder: undelivered TRANSACTION_ERROR: 29189
14:05:34 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40046305, 0x100000000000000}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:34 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000]}, 0x2c)

14:05:34 executing program 0:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
fadvise64(r0, 0x0, 0xfffffffffffffffa, 0x3)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1845.570222] binder: 15291:15305 got reply transaction with no transaction stack
[ 1845.577764] binder: 15291:15305 transaction failed 29201/-71, size 0-0 line 2801
14:05:34 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20100c0]})

[ 1845.649052] binder: undelivered TRANSACTION_ERROR: 29189
[ 1845.656164] binder: undelivered TRANSACTION_ERROR: 29201
14:05:34 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1845.733194] binder: BINDER_SET_CONTEXT_MGR already set
14:05:34 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000000000]}, 0x2c)

[ 1845.759280] binder: 15318:15319 got reply transaction with bad transaction stack, transaction 796 has target 15297:0
[ 1845.772893] binder: 15312:15313 ioctl 40046207 0 returned -16
[ 1845.780677] binder: 15318:15319 transaction failed 29201/-71, size 0-0 line 2816
[ 1845.789246] binder: release 15318:15319 transaction 796 out, still active
[ 1845.806582] binder: undelivered TRANSACTION_COMPLETE
[ 1845.815926] binder: 15313 RLIMIT_NICE not set
[ 1845.826551] binder: undelivered TRANSACTION_ERROR: 29201
14:05:34 executing program 3:
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1845.852016] binder: undelivered TRANSACTION_COMPLETE
[ 1845.921216] binder: 15325:15327 got reply transaction with bad transaction stack, transaction 801 has target 15297:0
[ 1845.937317] binder: 15325:15327 transaction failed 29201/-71, size 0-0 line 2816
[ 1845.946652] binder: undelivered TRANSACTION_COMPLETE
[ 1845.952722] binder: undelivered TRANSACTION_ERROR: 29201
[ 1846.348838] binder: BINDER_SET_CONTEXT_MGR already set
[ 1846.354436] binder_alloc: binder_alloc_mmap_handler: 15297 20005000-20009000 already mapped failed -16
[ 1846.357479] binder: 15297:15331 ioctl 40046207 0 returned -16
[ 1846.375382] binder_alloc_new_buf_locked: 2 callbacks suppressed
[ 1846.375390] binder_alloc: 15297: binder_alloc_buf, no vma
[ 1846.387248] binder: 15331 RLIMIT_NICE not set
[ 1846.392199] binder: send failed reply for transaction 792 to 15297:15303
[ 1846.399063] binder: send failed reply for transaction 795 to 15311:15315
[ 1846.399757] binder: 15297:15330 transaction failed 29189/-3, size 0-0 line 3035
[ 1846.414525] binder: send failed reply for transaction 796, target dead
[ 1846.414833] binder: 15311:15315 transaction failed 29189/-22, size 0-0 line 2896
[ 1846.428975] binder: undelivered TRANSACTION_COMPLETE
[ 1846.434751] binder: undelivered TRANSACTION_ERROR: 29189
14:05:35 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper={0x630b}], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:35 executing program 5:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40086310}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:35 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80ffff00000000]}, 0x2c)

14:05:35 executing program 3:
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:35 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x24d564b]})

[ 1846.448775] binder: undelivered TRANSACTION_ERROR: 29189
[ 1846.476624] binder: 15334:15335 transaction failed 29189/-22, size 0-0 line 2896
[ 1846.514777] binder: 15332:15333 BC_DEAD_BINDER_DONE 0000630c00000000 not found
14:05:35 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000000000000]}, 0x2c)

14:05:35 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="216304405701adc9"], 0x11, 0x0, &(0x7f0000000080)="622f525479257d5c831974a00d187402ea"})

[ 1846.531689] binder: 15334:15344 got reply transaction with no transaction stack
[ 1846.539219] binder: 15334:15344 transaction failed 29201/-71, size 0-0 line 2801
[ 1846.540532] binder: BINDER_SET_CONTEXT_MGR already set
[ 1846.599734] binder: 15342:15343 ioctl 40046207 0 returned -16
[ 1846.610947] binder: undelivered TRANSACTION_ERROR: 29189
[ 1846.617011] binder: undelivered TRANSACTION_ERROR: 29201
[ 1846.620981] binder: 15342:15347 ERROR: BC_REGISTER_LOOPER called without request
14:05:35 executing program 3:
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:35 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30001c0]})

[ 1846.645377] binder: 15348:15351 unknown command 1074029345
[ 1846.669695] binder: 15348:15351 ioctl c0306201 20000100 returned -22
[ 1846.681318] binder: 15352:15353 got reply transaction with bad transaction stack, transaction 813 has target 15332:0
14:05:35 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000000]}, 0x2c)

[ 1846.694745] binder: 15352:15353 transaction failed 29201/-71, size 0-0 line 2816
[ 1846.704448] binder: 15348:15355 unknown command 1074029345
[ 1846.721450] binder: undelivered TRANSACTION_COMPLETE
[ 1846.729232] binder: undelivered TRANSACTION_ERROR: 29201
[ 1846.763974] binder: undelivered TRANSACTION_COMPLETE
14:05:35 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300000000000000]}, 0x2c)

14:05:35 executing program 3:
perf_event_open(0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1846.785369] binder: 15348:15355 ioctl c0306201 20000100 returned -22
[ 1846.798813] binder: undelivered TRANSACTION_COMPLETE
[ 1846.876020] binder: 15367:15368 got reply transaction with bad transaction stack, transaction 816 has target 15332:0
[ 1846.915966] binder: 15367:15368 transaction failed 29201/-71, size 0-0 line 2816
[ 1847.285680] binder: send failed reply for transaction 810 to 15342:15347
[ 1847.298222] binder: 15342:15343 ERROR: BC_REGISTER_LOOPER called without request
14:05:36 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000000000]}, 0x2c)

14:05:36 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = syz_open_dev$adsp(&(0x7f0000000080)='/dev/adsp#\x00', 0x9, 0x0)
syz_genetlink_get_family_id$tipc2(&(0x7f0000000000)='TIPCv2\x00')
ioctl$SNDRV_TIMER_IOCTL_TREAD(r1, 0x40045402, &(0x7f00000000c0)=0x1)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0563044000000000d46b11b2c7974e18e212519623cb4f3418b8bbee79107fdb65650195f85bcd2c4a1483aed1f650948c9625f2fc979ea4271cc19ed21cf3e72d781b77e9b123db89ffc48a6e9f49c6212daefc3ed839186f9289f32071ce3438331edc88426a973207e555213a9c861baff1824c78fbbe54315ba7f3e3123b8e5f36b67aa010fe23c47895abcb485ef9c68f025a35d15c010d90a252a824647cd89e43753093f660d7fbd25dc87da50676e3d5b0c1cc6cf90e282a59e0c695e14e9b083b23e9ed88ca80632137580f09df8564f47821e52397f17d"], 0x1, 0x0, &(0x7f0000000040)="ea"})
openat$snapshot(0xffffffffffffff9c, &(0x7f0000000380)='/dev/snapshot\x00', 0x40, 0x0)

14:05:36 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30100c0]})

14:05:36 executing program 3:
perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:36 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper={0x630d}], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:36 executing program 5:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
fadvise64(r0, 0x0, 0xfffffffffffffffa, 0x3)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:05:36 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500000000000000]}, 0x2c)

14:05:36 executing program 3:
perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:36 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r2, 0x0)
sendto$inet6(r1, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r1, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)
ioctl$KVM_ARM_SET_DEVICE_ADDR(r0, 0x4010aeab, &(0x7f0000000140)={0x81, 0x1f004})
sendto$inet6(0xffffffffffffffff, &(0x7f0000000300), 0xfd90, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
add_key$keyring(&(0x7f0000000400)='keyring\x00', &(0x7f0000000440)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb)

14:05:36 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)=ANY=[], 0xffffffffffffffac, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:05:36 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x34d564b]})

[ 1847.575714] binder: 15392:15394 got reply transaction with bad transaction stack, transaction 828 has target 15383:0
14:05:36 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600000000000000]}, 0x2c)

[ 1847.638355] binder: 15397:15398 ioctl c0306201 20000140 returned -14
[ 1847.643920] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
[ 1847.674463] binder_thread_release: 8 callbacks suppressed
[ 1847.674473] binder: release 15392:15394 transaction 828 out, still active
14:05:36 executing program 3:
perf_event_open(&(0x7f0000000180)={0x0, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1847.701295] binder: 15397:15398 ioctl c0306201 20000140 returned -14
14:05:36 executing program 0:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000200)={{{@in=@local, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in=@broadcast}, 0x0, @in=@dev}}, &(0x7f00000000c0)=0xe8)
r4 = geteuid()
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000480)={{{@in=@dev, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in6}, 0x0, @in6=@loopback}}, &(0x7f0000000140)=0xe8)
r6 = geteuid()
fstat(r2, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, <r7=>0x0})
r8 = getuid()
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f00000005c0)={{{@in=@remote, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r9=>0x0}}, {{@in6=@remote}, 0x0, @in=@initdev}}, &(0x7f0000000400)=0xe8)
fstat(r0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, <r10=>0x0})
stat(&(0x7f0000000740)='./file0\x00', &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0, 0x0, <r11=>0x0})
getgroups(0x9, &(0x7f0000000800)=[0xee00, 0xee01, <r12=>0x0, 0xee01, 0xee01, 0xee00, 0xffffffffffffffff, 0xee01, 0x0])
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000840)={0x0, 0x0, <r13=>0x0}, &(0x7f0000000880)=0xc)
fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f00000008c0)={{}, {0x1, 0x4}, [{0x2, 0x4, r3}, {0x2, 0x1, r4}, {0x2, 0x4, r5}, {0x2, 0x3, r6}, {0x2, 0x4, r7}, {0x2, 0x6, r8}, {0x2, 0x0, r9}], {0x4, 0x6}, [{0x8, 0x3, r10}, {0x8, 0x0, r11}, {0x8, 0x1, r12}, {0x8, 0x4, r13}], {0x10, 0x6}, {0x20, 0x1}}, 0x7c, 0x1)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1847.806815] binder: 15408:15409 got reply transaction with bad transaction stack, transaction 831 has target 15383:0
14:05:36 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700000000000000]}, 0x2c)

14:05:36 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40001c0]})

[ 1847.887563] binder: release 15408:15409 transaction 831 out, still active
[ 1848.268077] binder_alloc: binder_alloc_mmap_handler: 15383 20005000-20009000 already mapped failed -16
[ 1848.278863] binder: BINDER_SET_CONTEXT_MGR already set
[ 1848.284954] binder: 15383:15425 ioctl 40046207 0 returned -16
[ 1848.291727] binder: release 15383:15384 transaction 826 out, still active
[ 1848.309822] binder_send_failed_reply: 8 callbacks suppressed
14:05:37 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000000000000]}, 0x2c)

14:05:37 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:37 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r2, 0x0)
sendto$inet6(r1, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r1, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)
ioctl$KVM_ARM_SET_DEVICE_ADDR(r0, 0x4010aeab, &(0x7f0000000140)={0x81, 0x1f004})
sendto$inet6(0xffffffffffffffff, &(0x7f0000000300), 0xfd90, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
add_key$keyring(&(0x7f0000000400)='keyring\x00', &(0x7f0000000440)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb)

14:05:37 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper={0x6312}], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:37 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44d564b]})

[ 1848.309842] binder: send failed reply for transaction 826, target dead
[ 1848.329702] binder: send failed reply for transaction 828, target dead
[ 1848.336437] binder: send failed reply for transaction 831, target dead
[ 1848.345378] binder: send failed reply for transaction 833 to 15411:15412
[ 1848.372371] binder_thread_write: 3 callbacks suppressed
[ 1848.372384] binder: 15411:15428 Acquire 1 refcount change on invalid ref 0 ret -22
[ 1848.388911] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
[ 1848.461230] binder: 15436:15437 unknown command 25362
14:05:37 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$mice(&(0x7f0000000080)='/dev/input/mice\x00', 0x0, 0x200)
ioctl$EVIOCGBITSW(r1, 0x80404525, &(0x7f00000000c0)=""/27)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:05:37 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:37 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900000000000000]}, 0x2c)

[ 1848.506008] binder: 15436:15437 ioctl c0306201 20000100 returned -22
14:05:37 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70001c0]})

[ 1848.633866] binder: 15447:15448 got reply transaction with bad transaction stack, transaction 843 has target 15436:0
[ 1848.646973] binder_alloc: binder_alloc_mmap_handler: 15436 20005000-20009000 already mapped failed -16
14:05:37 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00000000000000]}, 0x2c)

[ 1848.703594] binder: release 15447:15448 transaction 843 out, still active
[ 1848.730638] binder: BINDER_SET_CONTEXT_MGR already set
[ 1848.760802] binder: 15436:15449 ioctl 40046207 0 returned -16
[ 1848.782933] binder: 15436:15456 unknown command 25362
14:05:37 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1848.818928] binder_alloc: 15436: binder_alloc_buf, no vma
[ 1848.858330] binder: send failed reply for transaction 839 to 15436:15437
[ 1848.867986] binder: 15436:15456 ioctl c0306201 20000100 returned -22
[ 1848.887207] binder: send failed reply for transaction 841 to 15443:15446
14:05:37 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r2, 0x0)
sendto$inet6(r1, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r1, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)
ioctl$KVM_ARM_SET_DEVICE_ADDR(r0, 0x4010aeab, &(0x7f0000000140)={0x81, 0x1f004})
sendto$inet6(0xffffffffffffffff, &(0x7f0000000300), 0xfd90, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)
add_key$keyring(&(0x7f0000000400)='keyring\x00', &(0x7f0000000440)={'syz'}, 0x0, 0x0, 0xfffffffffffffffb)

14:05:37 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00000000000000]}, 0x2c)

[ 1848.916196] binder: send failed reply for transaction 843, target dead
14:05:38 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper={0x40046302}], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:38 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8010040]})

14:05:38 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1849.008676] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
14:05:38 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00000000000000]}, 0x2c)

14:05:38 executing program 0:
perf_event_open(&(0x7f0000000200)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffff814, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0x8001, 0x5}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mkdir(&(0x7f0000000140)='./file0\x00', 0x0)
mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000340)='./file0\x00', 0x0, 0x0)
getsockname$inet(r1, &(0x7f00000002c0)={0x2, 0x0, @empty}, &(0x7f0000000380)=0x10)
r2 = openat$cgroup_subtree(r1, &(0x7f00000001c0)='cgroup.subtree_control\x00', 0x2, 0x0)
getsockopt$bt_hci(r1, 0x0, 0x3, &(0x7f00000003c0)=""/104, &(0x7f0000000480)=0x68)
write$cgroup_subtree(r2, &(0x7f00000000c0)={[{0x2d, 'pids'}]}, 0x6)
ioctl$sock_inet6_tcp_SIOCOUTQ(r0, 0x5411, &(0x7f0000000080))
syz_open_dev$binder(0x0, 0x0, 0xffffeffffffffffc)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x11, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$RTC_EPOCH_READ(r1, 0x8008700d, &(0x7f0000000180))
ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000280))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1849.082763] binder: BC_ACQUIRE_RESULT not supported
[ 1849.087861] binder: 15470:15471 ioctl c0306201 20000100 returned -22
[ 1849.207625] binder: 15475:15479 got reply transaction with bad transaction stack, transaction 852 has target 15470:0
[ 1849.227844] binder_alloc: binder_alloc_mmap_handler: 15470 20005000-20009000 already mapped failed -16
[ 1849.247130] binder: release 15475:15479 transaction 852 out, still active
14:05:38 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00000000000000]}, 0x2c)

14:05:38 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1849.269989] binder: 15484:15485 ioctl 5411 20000080 returned -22
[ 1849.303673] binder_alloc: 15470: binder_alloc_buf, no vma
[ 1849.310659] binder: BINDER_SET_CONTEXT_MGR already set
14:05:38 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00000000000000]}, 0x2c)

[ 1849.331034] binder: 15470:15483 ioctl 40046207 0 returned -16
[ 1849.354938] binder_alloc: 15470: binder_alloc_buf, no vma
[ 1849.360965] binder: BC_ACQUIRE_RESULT not supported
[ 1849.366709] binder: 15484:15485 ioctl 5411 20000080 returned -22
14:05:38 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8030000]})

[ 1849.378885] binder: 15470:15493 ioctl c0306201 20000100 returned -22
[ 1849.395400] binder_alloc: 15470: binder_alloc_buf, no vma
[ 1849.411690] binder: send failed reply for transaction 850 to 15470:15471
[ 1849.438828] binder: send failed reply for transaction 852, target dead
[ 1849.475820] binder_alloc: 15470: binder_alloc_buf, no vma
14:05:38 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1849.481768] binder: 15484:15502 Acquire 1 refcount change on invalid ref 0 ret -22
14:05:38 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r2, 0x0)
sendto$inet6(r1, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r1, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)
ioctl$KVM_ARM_SET_DEVICE_ADDR(r0, 0x4010aeab, &(0x7f0000000140)={0x81, 0x1f004})
sendto$inet6(0xffffffffffffffff, &(0x7f0000000300), 0xfd90, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, 0x1c)

14:05:38 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00000000000000]}, 0x2c)

14:05:38 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper={0x40046304}], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:38 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:38 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000400)={<r2=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x6c, 0x0, &(0x7f0000000380)=[@clear_death={0x400c630f, 0x2, 0x1}, @reply_sg={0x40486312, {{0x0, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x50, 0x28, &(0x7f0000000200)=[@ptr={0x70742a85, 0x1, &(0x7f0000000080), 0x1, 0x1, 0x28}, @ptr={0x70742a85, 0x1, &(0x7f00000000c0), 0x1, 0x3, 0x17}], &(0x7f0000000140)=[0x18, 0x78, 0x28, 0x78, 0x28]}, 0x26b7518e}}, @free_buffer={0x40086303, r2}, @register_looper], 0x4a, 0x0, &(0x7f0000000480)="313c97f8c3f5a09e7bfc56e8ee2c2d70e13d52fabcee23c5076839797667e830ce07bc89c364d3b6775a3661a3c1db02c18de515bbd0815058aef23fd8768104eb0cfb20e78870288b23"})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\a\x00'], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:05:38 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa010000]})

[ 1849.739953] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
[ 1849.773715] binder: 15516:15525 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2
14:05:38 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000]}, 0x2c)

14:05:38 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1849.800013] binder: 15516:15525 got reply transaction with no transaction stack
[ 1849.832367] binder: 15516:15521 unknown command 7
[ 1849.861126] binder: 15516:15521 ioctl c0306201 20000100 returned -22
[ 1849.919370] binder: 15530:15531 got reply transaction with bad transaction stack, transaction 866 has target 15514:0
[ 1849.933013] binder: 15516:15521 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2
[ 1849.959655] binder: 15516:15532 unknown command 7
14:05:39 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1100000000000000]}, 0x2c)

14:05:39 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000]})

[ 1849.986718] binder: 15516:15532 ioctl c0306201 20000100 returned -22
[ 1850.000331] binder: release 15530:15531 transaction 866 out, still active
[ 1850.015924] binder: release 15516:15521 transaction 865 out, still active
[ 1850.046999] binder: 15516:15521 got reply transaction with no transaction stack
14:05:39 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1200000000000000]}, 0x2c)

14:05:39 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1850.099181] binder: release 15516:15525 transaction 868 out, still active
14:05:39 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r2, 0x0)
sendto$inet6(r1, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r1, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)
ioctl$KVM_ARM_SET_DEVICE_ADDR(r0, 0x4010aeab, &(0x7f0000000140)={0x81, 0x1f004})

14:05:39 executing program 0:
bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000000c0)={0xffffffffffffffff, 0x10, &(0x7f0000000080)={&(0x7f0000000200)=""/247, 0xf7, <r0=>0x0}}, 0x10)
r1 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000140)=r0, 0x4)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r3 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007000000000000000000000000000000009a9013d1d3468fe36395f1a6f81052cf87c066c47748dda8025e03b805dcba4423fac671f1b2d3238bbb8598ba59ea94db17a0f5eeb8aefa9e1e086b0ed38c368a042b521df755e9c77d10533622e75bfb74fa54bd7d6956d09de214abd2f18cb8f953cb6e0038b1464a8dda677453fb94d9a11632cf14c8d0cc0d57760baf941574f7215b39f306099862f84bbd8d695ff24d9dc600000000000000000000000000a3a54a5d04094c357ef0b629c54f055f556ecc186894258fbefd0ec73d0694e506f98fe20cb25c8c605e28312904c39438af5348395f429da4878bafc46fd143f51ef8a595f1161f32c3"], 0x0, 0x0, 0x0})
r4 = dup3(r3, r1, 0x80000)
setsockopt$inet_sctp_SCTP_HMAC_IDENT(r4, 0x84, 0x16, &(0x7f0000000300)={0x3, [0x0, 0x1ff, 0x7]}, 0xa)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00'], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1850.216082] binder: 15543:15544 got reply transaction with bad transaction stack, transaction 870 has target 15514:0
[ 1850.299053] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
[ 1850.317795] binder_alloc: 15514: binder_alloc_buf size 504403158265495552 failed, no address space
[ 1850.329231] binder: release 15543:15544 transaction 870 out, still active
[ 1850.342273] binder_release_work: 14 callbacks suppressed
[ 1850.342279] binder: undelivered TRANSACTION_COMPLETE
[ 1850.368263] binder_alloc: allocated: 40 (num: 5 largest: 8), free: 16344 (num: 1 largest: 16344)
[ 1850.405442] binder: 15549:15554 unknown command 0
[ 1850.429399] binder: 15549:15554 ioctl c0306201 20000100 returned -22
[ 1850.475288] binder_alloc: 15514: binder_alloc_buf size 504403158265495552 failed, no address space
[ 1850.516129] binder: BINDER_SET_CONTEXT_MGR already set
[ 1850.531105] binder: 15514:15520 ioctl 40046207 0 returned -16
[ 1850.545398] binder_alloc: allocated: 40 (num: 5 largest: 8), free: 16344 (num: 1 largest: 16344)
[ 1850.564994] binder: 15549:15556 unknown command 0
[ 1850.571952] binder: 15549:15556 ioctl c0306201 20000100 returned -22
[ 1850.584494] binder_release_work: 20 callbacks suppressed
[ 1850.584501] binder: undelivered TRANSACTION_ERROR: 29201
[ 1850.599629] binder: send failed reply for transaction 862 to 15514:15524
[ 1850.606398] binder_alloc: 15514: binder_alloc_buf, no vma
[ 1850.613554] binder_transaction: 24 callbacks suppressed
[ 1850.613572] binder: 15549:15551 transaction failed 29201/-28, size 0-504403158265495552 line 3035
[ 1850.630168] binder: send failed reply for transaction 865, target dead
[ 1850.636988] binder: send failed reply for transaction 866, target dead
[ 1850.639528] binder: 15514:15557 transaction failed 29189/-3, size 0-0 line 3035
[ 1850.646483] binder: send failed reply for transaction 868, target dead
[ 1850.658604] binder: send failed reply for transaction 870, target dead
14:05:39 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11000000]})

14:05:39 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper={0x40046307}], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:39 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1300000000000000]}, 0x2c)

14:05:39 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:39 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r1, 0x0)
sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

[ 1850.665833] binder: undelivered TRANSACTION_COMPLETE
[ 1850.675655] binder: undelivered TRANSACTION_ERROR: 29189
[ 1850.681349] binder: undelivered TRANSACTION_ERROR: 29189
[ 1850.739942] binder: undelivered TRANSACTION_ERROR: 29201
[ 1850.750179] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
14:05:39 executing program 0:
syz_open_dev$dri(&(0x7f0000000080)='/dev/dri/card#\x00', 0xfffffffffffff098, 0x20000)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
geteuid()
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:05:39 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1400000000000000]}, 0x2c)

[ 1850.794144] binder: 15569 invalid dec weak, ref 878 desc 0 s 1 w 0
14:05:39 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:40 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12000000]})

14:05:40 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1500000000000000]}, 0x2c)

14:05:40 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:40 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1800000000000000]}, 0x2c)

14:05:40 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r1, 0x0)
sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

[ 1851.292124] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
[ 1851.568481] binder: BINDER_SET_CONTEXT_MGR already set
[ 1851.574175] binder_alloc: binder_alloc_mmap_handler: 15569 20005000-20009000 already mapped failed -16
[ 1851.586170] binder: 15569:15602 ioctl 40046207 0 returned -16
[ 1851.592810] binder_alloc: 15569: binder_alloc_buf, no vma
[ 1851.598610] binder: 15569:15601 transaction failed 29189/-3, size 0-0 line 3035
[ 1851.606680] binder: 15569 invalid dec weak, ref 882 desc 0 s 1 w 0
[ 1851.613520] binder: release 15569:15570 transaction 877 out, still active
[ 1851.623540] binder: undelivered TRANSACTION_COMPLETE
[ 1851.634947] binder: undelivered TRANSACTION_ERROR: 29189
[ 1851.646925] binder: send failed reply for transaction 877, target dead
[ 1851.661122] binder: send failed reply for transaction 879 to 15576:15577
14:05:40 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper={0x40086303}], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:40 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x150001c0]})

14:05:40 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00000000000000]}, 0x2c)

14:05:40 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1851.673187] binder: 15576:15577 transaction failed 29189/-22, size 0-0 line 2896
[ 1851.700994] binder: 15604:15605 got reply transaction with no transaction stack
[ 1851.739600] binder: 15604:15605 transaction failed 29201/-71, size 0-0 line 2801
[ 1851.747837] binder: 15576:15613 Acquire 1 refcount change on invalid ref 0 ret -22
[ 1851.757816] binder: 15610:15611 BC_FREE_BUFFER u0000000000000000 no match
[ 1851.800943] binder: undelivered TRANSACTION_ERROR: 29201
[ 1851.815751] binder: undelivered TRANSACTION_ERROR: 29189
14:05:40 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000"], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="d300001d75d4cf00"], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:05:40 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r1, 0x0)
sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

14:05:40 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe4ffffff00000000]}, 0x2c)

14:05:40 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x170101c0]})

14:05:40 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1851.920698] binder: 15623:15624 got reply transaction with no transaction stack
[ 1851.928254] binder: 15623:15624 transaction failed 29201/-71, size 0-0 line 2801
[ 1851.937358] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
14:05:41 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff00000000]}, 0x2c)

[ 1851.968976] binder: 15625:15627 unknown command 486539475
[ 1851.981947] binder: 15625:15627 ioctl c0306201 20000100 returned -22
14:05:41 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1b000000]})

[ 1852.032092] binder: 15625:15630 unknown command 486539475
[ 1852.056913] binder: 15625:15630 ioctl c0306201 20000100 returned -22
[ 1852.059781] binder: undelivered TRANSACTION_ERROR: 29201
14:05:41 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1852.081706] binder: undelivered TRANSACTION_COMPLETE
[ 1852.094339] binder: undelivered TRANSACTION_COMPLETE
[ 1852.186038] binder: 15636:15639 got reply transaction with no transaction stack
[ 1852.228849] binder: 15636:15639 transaction failed 29201/-71, size 0-0 line 2801
[ 1852.255762] binder: undelivered TRANSACTION_ERROR: 29201
[ 1852.527168] binder_alloc: binder_alloc_mmap_handler: 15610 20005000-20009000 already mapped failed -16
[ 1852.537155] binder: BINDER_SET_CONTEXT_MGR already set
[ 1852.542547] binder: 15610:15645 ioctl 40046207 0 returned -16
[ 1852.548652] binder: 15610:15644 BC_FREE_BUFFER u0000000000000000 no match
[ 1852.548677] binder_alloc: 15610: binder_alloc_buf, no vma
[ 1852.561518] binder: undelivered TRANSACTION_COMPLETE
[ 1852.569934] binder: 15610:15643 transaction failed 29189/-3, size 0-0 line 3035
14:05:41 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper={0x4008630a}], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:41 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2]}, 0x2c)

14:05:41 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d9fe68914e2838fd98e29ec92b55440000000000000000f0ffffff0081257265d7cb075e5b2adc9fcc2f647ddb3b49d8fcfc8ec8f757ec27c9a33e908f17427466cf24daf781489ee734d9ac2f976e0d7e"], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:05:41 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r1, 0x0)
sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

14:05:41 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1b0001c0]})

14:05:41 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1852.609866] binder: undelivered TRANSACTION_ERROR: 29189
[ 1852.660916] binder: 15653:15654 ioctl c0306201 0 returned -14
[ 1852.670069] binder: 15649:15650 transaction failed 29189/-22, size 0-0 line 2896
[ 1852.678961] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
[ 1852.700944] binder: 15649:15650 transaction failed 29189/-22, size 0-0 line 2896
14:05:41 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}, 0x2c)

[ 1852.711038] binder: 15653:15660 got reply transaction with no transaction stack
[ 1852.720974] binder: BC_ATTEMPT_ACQUIRE not supported
14:05:41 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$radio(&(0x7f00000002c0)='/dev/radio#\x00', 0x0, 0x2)
getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, &(0x7f0000000480)={<r2=>0x0, @in={{0x2, 0x4e20, @broadcast}}, 0x80, 0x9, 0x3, 0xf18d, 0x6}, &(0x7f0000000400)=0x98)
setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r1, 0x84, 0x22, &(0x7f0000000540)={0x8a, 0x8000, 0x800, 0x7331, r2}, 0x10)
clock_gettime(0x0, &(0x7f0000000380)={<r3=>0x0, <r4=>0x0})
setsockopt$sock_timeval(r1, 0x1, 0x15, &(0x7f00000003c0)={r3, r4/1000+30000}, 0x10)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
r5 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x3, 0x2)
ioctl$DRM_IOCTL_RES_CTX(r5, 0xc0106426, &(0x7f0000000140)={0x6, &(0x7f00000000c0)=[{}, {}, {}, {}, {}, {}]})
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$KVM_GET_EMULATED_CPUID(r5, 0xc008ae09, &(0x7f0000000200)=""/122)
ioctl$EVIOCSKEYCODE(r5, 0x40084504, &(0x7f0000000280)=[0x8, 0x7])
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1852.780992] binder: 15656:15659 ioctl c0306201 20000100 returned -22
14:05:41 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1852.856067] binder_alloc: binder_alloc_mmap_handler: 15656 20005000-20009000 already mapped failed -16
14:05:41 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x2c)

[ 1852.897806] binder: BINDER_SET_CONTEXT_MGR already set
14:05:41 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1e010000]})

14:05:41 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r1, 0x0)
sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

[ 1852.929633] binder_alloc: 15656: binder_alloc_buf, no vma
[ 1852.937016] binder: 15656:15666 ioctl 40046207 0 returned -16
[ 1852.941810] binder: 15670:15671 ioctl c0306201 0 returned -14
[ 1852.960857] binder: BC_ATTEMPT_ACQUIRE not supported
[ 1852.968990] binder: 15670:15671 got reply transaction with no transaction stack
[ 1852.990618] binder_alloc: 15656: binder_alloc_buf, no vma
[ 1853.014738] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
[ 1853.019279] binder_thread_release: 3 callbacks suppressed
[ 1853.019289] binder: release 15656:15659 transaction 898 out, still active
[ 1853.039410] binder: 15656:15677 ioctl c0306201 20000100 returned -22
[ 1853.059541] binder: undelivered TRANSACTION_COMPLETE
14:05:42 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper={0x40086310}], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:42 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5]}, 0x2c)

14:05:42 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:42 executing program 0:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000006000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r0, 0x2405, r0)
r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000240)='/dev/rtc0\x00', 0x200000, 0x0)
clock_gettime(0x0, &(0x7f0000000280)={<r4=>0x0, <r5=>0x0})
clock_gettime(0x0, &(0x7f00000002c0)={<r6=>0x0, <r7=>0x0})
write$evdev(r3, &(0x7f0000000480)=[{{0x0, 0x7530}, 0x11, 0x3af, 0x6}, {{0x0, 0x2710}, 0x15, 0x9, 0x3ff}, {{}, 0x0, 0x8, 0x3d}, {{}, 0x13, 0x1, 0x7}, {{0x0, 0x2710}, 0x5, 0x100000001, 0x8d2}, {{r4, r5/1000+10000}, 0x11, 0x101, 0x80}, {{}, 0x16, 0x3}, {{r6, r7/1000+30000}, 0x5, 0x200}, {{0x77359400}, 0x17, 0x3, 0x3}, {{0x77359400}, 0x17, 0x40, 0x1}], 0xf0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="056344400b000000"], 0x1, 0x0, &(0x7f0000000040)="ea"})
r8 = getpgrp(0x0)
bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={<r9=>0x0, r0, 0x0, 0x9, &(0x7f0000000080)='[#cgroup\x00', 0xffffffffffffffff}, 0x30)
socket$vsock_stream(0x28, 0x1, 0x0)
r10 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000380)='/dev/snapshot\x00', 0x101000, 0x0)
kcmp$KCMP_EPOLL_TFD(r8, r9, 0x7, r2, &(0x7f0000000200)={r10, r2, 0x5})

[ 1853.181977] binder: 15687:15688 ioctl c0306201 0 returned -14
14:05:42 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6]}, 0x2c)

[ 1853.240731] binder: 15690:15691 BC_DEAD_BINDER_DONE 0000000000000000 not found
[ 1853.240992] binder: 15687:15693 got reply transaction with no transaction stack
14:05:42 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r1, 0x0)
sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

[ 1853.286014] binder: BINDER_SET_CONTEXT_MGR already set
14:05:42 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f0001c0]})

[ 1853.331695] binder: 15695:15696 ioctl 40046207 0 returned -16
[ 1853.364197] binder: 15695:15700 unknown command 1078223621
14:05:42 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7]}, 0x2c)

[ 1853.391820] binder: 15695:15700 ioctl c0306201 20000100 returned -22
[ 1853.420422] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
14:05:42 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1853.476289] binder: BINDER_SET_CONTEXT_MGR already set
[ 1853.513487] binder: 15695:15700 ioctl 40046207 0 returned -16
14:05:42 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8]}, 0x2c)

[ 1853.534500] binder: 15695:15696 unknown command 1078223621
[ 1853.543645] binder: 15711:15713 got reply transaction with no transaction stack
[ 1853.565720] binder: 15695:15696 ioctl c0306201 20000100 returned -22
14:05:42 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r1, 0x0)
sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

[ 1853.588430] binder: release 15695:15700 transaction 910 out, still active
[ 1853.613415] binder: undelivered TRANSACTION_COMPLETE
14:05:42 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200001c0]})

[ 1853.650004] binder: release 15695:15696 transaction 911 out, still active
[ 1853.703055] binder: undelivered TRANSACTION_COMPLETE
[ 1853.721776] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
[ 1854.000024] binder_alloc: binder_alloc_mmap_handler: 15690 20005000-20009000 already mapped failed -16
[ 1854.018819] binder: BINDER_SET_CONTEXT_MGR already set
[ 1854.024385] binder: 15690:15730 ioctl 40046207 0 returned -16
[ 1854.039401] binder: 15690:15729 BC_DEAD_BINDER_DONE 0000000000000000 not found
[ 1854.048698] binder: send failed reply for transaction 907 to 15690:15691
[ 1854.063426] binder_alloc: 15690: binder_alloc_buf, no vma
[ 1854.069038] binder_send_failed_reply: 4 callbacks suppressed
[ 1854.069044] binder: send failed reply for transaction 910, target dead
[ 1854.089371] binder: send failed reply for transaction 911, target dead
14:05:43 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper={0x400c630e}], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:43 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:43 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9]}, 0x2c)

14:05:43 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/rfkill\x00', 0x400, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})
r2 = dup(r0)
setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000000080)={@initdev={0xac, 0x1e, 0x1, 0x0}, @multicast1, 0x0, 0xa, [@broadcast, @loopback, @dev={0xac, 0x14, 0x14, 0xb}, @multicast1, @dev={0xac, 0x14, 0x14, 0x29}, @empty, @dev={0xac, 0x14, 0x14, 0x19}, @dev={0xac, 0x14, 0x14, 0x15}, @rand_addr=0x9, @remote]}, 0x38)

14:05:43 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x221001c0]})

14:05:43 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r1, 0x0)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

[ 1854.096324] binder: undelivered TRANSACTION_COMPLETE
[ 1854.166982] binder: 15736:15738 got reply transaction with no transaction stack
[ 1854.177134] binder_alloc: 15737: binder_alloc_buf, no vma
14:05:43 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa]}, 0x2c)

[ 1854.217436] binder: BINDER_SET_CONTEXT_MGR already set
[ 1854.257259] binder: 15742:15743 ioctl 40046207 0 returned -16
14:05:43 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r1, 0x0)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

14:05:43 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1854.263813] binder: BINDER_SET_CONTEXT_MGR already set
14:05:43 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2a1001c0]})

[ 1854.306530] binder: 15737:15746 ioctl 40046207 0 returned -16
[ 1854.335620] binder: 15753:15754 got reply transaction with no transaction stack
14:05:43 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb]}, 0x2c)

[ 1854.351944] binder_alloc: 15737: binder_alloc_buf, no vma
[ 1854.390785] binder_alloc: 15737: binder_alloc_buf, no vma
[ 1854.410311] binder_alloc: binder_alloc_mmap_handler: 15742 20005000-20009000 already mapped failed -16
14:05:43 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0xfffffffffffffffc)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1854.457611] binder_alloc: 15742: binder_alloc_buf, no vma
14:05:43 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper={0x400c630f}], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:43 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r1, 0x0)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

14:05:43 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:43 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc]}, 0x2c)

14:05:43 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd]}, 0x2c)

[ 1854.641039] binder: 15771:15772 got reply transaction with no transaction stack
[ 1854.670417] binder: 15776:15778 BC_CLEAR_DEATH_NOTIFICATION death notification not active
14:05:43 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2c1001c0]})

14:05:43 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:43 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x20000, 0x0)
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000480)={{{@in6=@initdev, @in6=@ipv4={[], [], @multicast1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{@in6=@local}, 0x0, @in6=@remote}}, &(0x7f0000000140)=0xe8)
sendmsg$can_bcm(r1, &(0x7f0000000400)={&(0x7f0000000280)={0x1d, r2}, 0x10, &(0x7f00000002c0)={&(0x7f0000000380)={0x4, 0x34, 0x4f, {0x77359400}, {0x0, 0x2710}, {0x1, 0x7, 0x100000000, 0xfffffffffffffe00}, 0x1, @canfd={{0x2, 0xef2, 0x80, 0x9}, 0x1b, 0x3, 0x0, 0x0, "51ca50eef9e2f67de33f61ff959b9e55563a04a04281e97ee9140a3c675b4631996a12d91e259475fea3b34b173d84015e208fe8444408f86ada0da511819e63"}}, 0x80}, 0x1, 0x0, 0x0, 0x40}, 0x800)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:05:43 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

14:05:43 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe]}, 0x2c)

14:05:43 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:44 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x34000000]})

[ 1855.300029] device bridge_slave_1 left promiscuous mode
[ 1855.305591] bridge0: port 2(bridge_slave_1) entered disabled state
[ 1855.360751] device bridge_slave_0 left promiscuous mode
[ 1855.366435] bridge0: port 1(bridge_slave_0) entered disabled state
[ 1855.441034] binder: BINDER_SET_CONTEXT_MGR already set
[ 1855.446371] binder: 15776:15808 ioctl 40046207 0 returned -16
[ 1855.446622] binder_alloc: binder_alloc_mmap_handler: 15776 20005000-20009000 already mapped failed -16
[ 1855.486041] binder: 15776:15808 BC_CLEAR_DEATH_NOTIFICATION death notification not active
[ 1855.494890] binder_alloc: 15776: binder_alloc_buf, no vma
[ 1855.509835] binder: release 15776:15778 transaction 928 out, still active
[ 1855.516829] binder: undelivered TRANSACTION_COMPLETE
[ 1855.529672] binder: send failed reply for transaction 928, target dead
14:05:44 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper={0x40106308}], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:44 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf]}, 0x2c)

14:05:44 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

14:05:44 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:44 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a000000]})

[ 1855.536377] binder: send failed reply for transaction 930 to 15786:15788
14:05:44 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10]}, 0x2c)

[ 1855.637961] binder_transaction: 18 callbacks suppressed
[ 1855.637984] binder: 15814:15821 transaction failed 29189/-22, size 0-0 line 2896
[ 1855.658613] binder: 15819:15822 BC_INCREFS_DONE u0000000000000000 no match
14:05:44 executing program 0:
r0 = perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$FS_IOC_GETFSMAP(r0, 0xc0c0583b, &(0x7f00000005c0)=ANY=[@ANYBLOB="000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000f8ffff010000000000000015f300000000000002000000000000000080000000005380430000000000000e8e020cd6bed4100000000000000000e6ff00000000000000000000070000001f0000000100000000000000ffff00000000000000020000000000000104000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000eb1b5ba0763d52a6c31bf63d2eff71eb2d456082a0536a73e54385046abdbde5169fa37935f054aeb1f7312bf526372b60ed1a51f58483c0a2bfe63c589acbe5a8d0ea7ade93b847be0142c6f30ac2cecbdb2bfa37"])
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
r2 = syz_open_dev$vcsa(&(0x7f0000000080)='/dev/vcsa#\x00', 0x2, 0x1c840)
ioctl$KDSKBSENT(r2, 0x4b49, &(0x7f0000000740)="76e17257d7a2a1532d712d46b8f8644dbe27b520101e0c6445227ecf429e3921c8586595f4036065536ece0d706c25d948887996e11ccc48e0c3a179550276e053bd051ec6920ee6ef67c2bf139542ff4a4f9bd8e53c204a698374b4961cf74f3ff8ae91c5c0457297e05ba4fc2cbe32eafd0db5f326882bce4b79680e6dc1d8496b9cf53a489b85ed3f2064caf04f127e2027dd5e2bf7d64d3aa40e996f535d20c88d11271b10ea833ce21dbd38f4d8f8daa10ddd59edf98e1bcb6365daa90881bf9b031f2d714492b14d7cb99c145f645e90da7a5f44da8770caf82fc901038499828b115b2a7c708d98a874142a4b3d9a5afe52862f0a5d06f69d5b586bf541fc94272fbe3f2e996a1423c01d188a9c1133000fcf7c7365876718e93cbc7b56e6b11a0a1dcb73747768fb2b94285fa6ab9347235ca5ccd364af08331ab3bc23e0dffb81cc568280afd856785fe10864fa484d175eb2f5e2e9b0c0bd5c603cbb6993298e9709")
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
getsockopt$inet6_mreq(r2, 0x29, 0x15, &(0x7f00000000c0)={@mcast2}, &(0x7f0000000140)=0x14)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1855.699750] binder_release_work: 17 callbacks suppressed
[ 1855.699757] binder: undelivered TRANSACTION_ERROR: 29189
14:05:44 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:44 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3b000000]})

14:05:44 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11]}, 0x2c)

[ 1855.844778] binder: release 15829:15830 transaction 943 out, still active
[ 1855.876568] binder: undelivered TRANSACTION_COMPLETE
14:05:44 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}, @enter_looper], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:44 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

[ 1856.003189] binder: release 15839:15840 transaction 944 out, still active
[ 1856.018410] binder: undelivered TRANSACTION_COMPLETE
[ 1856.419224] binder_alloc: binder_alloc_mmap_handler: 15819 20005000-20009000 already mapped failed -16
[ 1856.429334] binder: BINDER_SET_CONTEXT_MGR already set
[ 1856.435594] binder: 15819:15848 ioctl 40046207 0 returned -16
[ 1856.441731] binder: 15819:15847 BC_INCREFS_DONE u0000000000000000 no match
[ 1856.449075] binder: send failed reply for transaction 939 to 15819:15822
[ 1856.456923] binder: send failed reply for transaction 941 to 15826:15828
14:05:45 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper={0x40106309}], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:45 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x12]}, 0x2c)

14:05:45 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3f000000]})

14:05:45 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

14:05:45 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
listen(r1, 0x0)
sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

[ 1856.464018] binder: send failed reply for transaction 943, target dead
[ 1856.472574] binder: 15826:15828 transaction failed 29189/-22, size 0-0 line 2896
[ 1856.480342] binder: send failed reply for transaction 944, target dead
[ 1856.488180] binder: 15826:15849 Acquire 1 refcount change on invalid ref 0 ret -22
[ 1856.496398] binder: undelivered TRANSACTION_COMPLETE
[ 1856.501759] binder: undelivered TRANSACTION_ERROR: 29189
[ 1856.542881] binder: 15855:15857 transaction failed 29189/-22, size 0-0 line 2896
[ 1856.548343] binder: undelivered TRANSACTION_ERROR: 29189
14:05:45 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000240)='/dev/sequencer\x00', 0x400, 0x0)
ioctl$sock_TIOCOUTQ(r1, 0x5411, &(0x7f0000000280))
syz_open_dev$audion(&(0x7f00000002c0)='/dev/audio#\x00', 0x7, 0x121080)
r2 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
openat$ipvs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/sys/net/ipv4/vs/snat_reroute\x00', 0x2, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
r3 = dup(r2)
write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000080)={<r4=>0xffffffffffffffff}, 0x13f, 0x100b}}, 0x20)
write$RDMA_USER_CM_CMD_DISCONNECT(r3, &(0x7f0000000140)={0xa, 0x4, 0xfa00, {r4}}, 0xc)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:05:45 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
listen(r1, 0x0)
sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

14:05:45 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x13]}, 0x2c)

[ 1856.620313] binder: 15855:15857 ioctl c0306201 0 returned -14
[ 1856.632027] binder: 15860:15861 BC_ACQUIRE_DONE u0000000000000000 no match
[ 1856.660003] binder: undelivered TRANSACTION_ERROR: 29189
14:05:45 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

14:05:45 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000]})

14:05:45 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x14]}, 0x2c)

[ 1856.838808] binder: 15874:15875 ioctl c0306201 0 returned -14
[ 1856.894010] binder: release 15874:15875 transaction 953 out, still active
[ 1856.914398] binder: undelivered TRANSACTION_COMPLETE
14:05:46 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
listen(r1, 0x0)
sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

[ 1857.404177] binder_alloc: binder_alloc_mmap_handler: 15860 20005000-20009000 already mapped failed -16
[ 1857.414200] binder: BINDER_SET_CONTEXT_MGR already set
[ 1857.419771] binder: 15860:15888 ioctl 40046207 0 returned -16
[ 1857.425852] binder: 15860:15887 BC_ACQUIRE_DONE u0000000000000000 no match
[ 1857.425876] binder_alloc: 15860: binder_alloc_buf, no vma
[ 1857.433291] binder: release 15860:15861 transaction 949 out, still active
[ 1857.446548] binder: undelivered TRANSACTION_COMPLETE
[ 1857.451824] binder: send failed reply for transaction 949, target dead
[ 1857.458536] binder: send failed reply for transaction 951 to 15863:15864
[ 1857.465474] binder: send failed reply for transaction 953, target dead
[ 1857.467846] binder: 15863:15864 transaction failed 29189/-22, size 0-0 line 2896
[ 1857.472399] binder: 15860:15886 transaction failed 29189/-3, size 0-0 line 3035
14:05:46 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper={0x40406300}], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:46 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0)

14:05:46 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x15]}, 0x2c)

14:05:46 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000009f]})

14:05:46 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r1, 0x0)
sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

[ 1857.509842] binder: undelivered TRANSACTION_ERROR: 29189
[ 1857.572455] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
[ 1857.593297] binder: 15898:15900 transaction failed 29189/-22, size 0-0 line 2896
[ 1857.632302] binder: 15896:15902 got new transaction with bad transaction stack, transaction 959 has target 15896:0
14:05:46 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18]}, 0x2c)

14:05:46 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0xffffffffffffff01, 0x3e8, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0563044000000000"], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1857.689710] binder: 15896:15902 transaction failed 29201/-71, size 0-0 line 2946
[ 1857.697876] binder: 15898:15900 ioctl c0306201 0 returned -14
[ 1857.722237] binder: undelivered TRANSACTION_ERROR: 29189
14:05:46 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x300]}, 0x2c)

14:05:46 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1857.766465] binder_alloc: binder_alloc_mmap_handler: 15896 20005000-20009000 already mapped failed -16
[ 1857.769966] binder_alloc: 15896: binder_alloc_buf, no vma
[ 1857.801836] binder: BINDER_SET_CONTEXT_MGR already set
14:05:46 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000b0]})

[ 1857.817963] binder: 15907:15908 transaction failed 29189/-3, size 0-0 line 3035
[ 1857.852692] binder: 15896:15909 ioctl 40046207 0 returned -16
[ 1857.866252] binder_alloc: 15896: binder_alloc_buf, no vma
[ 1857.878422] binder: release 15896:15902 transaction 959 out, still active
[ 1857.889860] binder: undelivered TRANSACTION_COMPLETE
[ 1857.896284] binder_alloc: 15896: binder_alloc_buf, no vma
[ 1857.905206] binder: 15907:15911 transaction failed 29189/-3, size 0-0 line 3035
[ 1857.909208] binder: undelivered TRANSACTION_ERROR: 29201
14:05:46 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x500]}, 0x2c)

[ 1857.916152] binder_alloc: 15896: binder_alloc_buf, no vma
[ 1857.928883] binder: send failed reply for transaction 959, target dead
[ 1857.942118] binder: 15896:15912 transaction failed 29189/-3, size 0-0 line 3035
[ 1857.976281] binder: undelivered TRANSACTION_ERROR: 29189
[ 1857.995712] binder: undelivered TRANSACTION_ERROR: 29189
[ 1858.008128] binder_alloc: 15896: binder_alloc_buf, no vma
14:05:47 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x600]}, 0x2c)

[ 1858.030251] binder: undelivered TRANSACTION_ERROR: 29189
14:05:47 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper={0x40406301}], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:47 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="006340400000000000000000000000ebffffff008000000000000000000000000000019062462c5975814d2608000000a2c0310000000008000000fa0017000000000000880d95fe028fe8dbc17047a4bf29d42df2e91a3308e2456db129b5762eeaa8edf73310cbbfb1a193c1505d331130547203249a530ed106ab4aba0023d4782c893c929611a4038bb3ca8bb402c5e30353929e2cae86bceb680bd1fdab6d5b8dab32c1f9e822039cb6fd321da079be670b83b141ea85c180465012d7de410989db6abdede0543c75d946a206ba98d960178c2e9a56e531c71839cf1fba20457ed7af00000000000000000000"], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="056304410000f82203f1300000"], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:05:47 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(0xffffffffffffffff, 0x0)
sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

14:05:47 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:47 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000b7]})

14:05:47 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x700]}, 0x2c)

14:05:47 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1858.284233] binder: 15936:15949 got reply transaction with bad transaction stack, transaction 971 has target 15936:0
[ 1858.301130] binder_alloc: 15936: binder_alloc_buf size 2774008563531269744 failed, no address space
14:05:47 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x900]}, 0x2c)

14:05:47 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(0xffffffffffffffff, 0x0)
sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

14:05:47 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000100]})

[ 1858.347345] binder: 15941:15953 unknown command 1090806533
[ 1858.353850] binder_alloc: allocated: 8 (num: 1 largest: 8), free: 16376 (num: 1 largest: 16376)
[ 1858.385741] binder: BINDER_SET_CONTEXT_MGR already set
[ 1858.423743] binder: 15936:15949 ioctl 40046207 0 returned -16
[ 1858.438714] binder: 15941:15953 ioctl c0306201 20000100 returned -22
[ 1858.457418] binder_transaction: 2 callbacks suppressed
[ 1858.457427] binder: 15936:15964 got reply transaction with no transaction stack
[ 1858.466881] binder_alloc: 15936: binder_alloc_buf, no vma
14:05:47 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(0xffffffffffffffff, 0x0)
sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

14:05:47 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00]}, 0x2c)

[ 1858.500557] binder: 15941:15950 unknown command 1090806533
[ 1858.506324] binder_alloc: 15936: binder_alloc_buf, no vma
[ 1858.524771] binder: 15941:15950 ioctl c0306201 20000100 returned -22
[ 1858.537853] binder: release 15936:15949 transaction 971 out, still active
[ 1858.552163] binder: undelivered TRANSACTION_COMPLETE
[ 1858.557402] binder: send failed reply for transaction 971, target dead
[ 1858.583206] binder_alloc: 15936: binder_alloc_buf, no vma
14:05:47 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper={0x40486311}], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:47 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:47 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb00]}, 0x2c)

14:05:47 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r0, 0x0)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

14:05:47 executing program 0:
r0 = openat$vhci(0xffffffffffffff9c, &(0x7f0000000080)='/dev/vhci\x00', 0x101000)
r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/vga_arbiter\x00', 0x4e20ee9528bfa720, 0x0)
sendfile(r0, r1, 0x0, 0x1)
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xffffffffffffff82, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000140)={<r3=>0xffffffffffffffff}, 0x0, 0x9}}, 0x20)
write$RDMA_USER_CM_CMD_INIT_QP_ATTR(r1, &(0x7f0000000380)={0xb, 0x10, 0xfa00, {&(0x7f0000000200), r3, 0x6}}, 0x18)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:05:47 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xc00]}, 0x2c)

14:05:47 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000108]})

14:05:47 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r0, 0x0)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

14:05:47 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire={0x40406301}], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1858.781662] binder: 15980:15983 Acquire 1 refcount change on invalid ref 0 ret -22
[ 1858.801161] binder: 15984:15985 got new transaction with bad transaction stack, transaction 982 has target 15984:0
14:05:47 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd00]}, 0x2c)

[ 1858.908646] binder: 15995:15996 got reply transaction with bad transaction stack, transaction 985 has target 15984:0
[ 1858.923561] binder_alloc: binder_alloc_mmap_handler: 15984 20005000-20009000 already mapped failed -16
14:05:48 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x121040, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r0, 0x0)
sendto$inet6(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

[ 1858.972304] binder_alloc: 15984: binder_alloc_buf, no vma
[ 1858.991599] binder: BINDER_SET_CONTEXT_MGR already set
[ 1859.039943] binder: 15984:15998 ioctl 40046207 0 returned -16
[ 1859.050195] binder: release 15995:15996 transaction 985 out, still active
[ 1859.076799] binder: undelivered TRANSACTION_COMPLETE
14:05:48 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000), 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1859.107464] binder: send failed reply for transaction 982 to 15984:15985
[ 1859.147160] binder: send failed reply for transaction 985, target dead
14:05:48 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper={0x40486312}], 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:48 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe00]}, 0x2c)

14:05:48 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r1, 0x0)
sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

14:05:48 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40010000]})

[ 1859.227348] binder: undelivered TRANSACTION_COMPLETE
[ 1859.260672] binder: 16019:16020 got reply transaction with bad transaction stack, transaction 992 has target 16019:0
[ 1859.268062] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
[ 1859.274320] binder_alloc: binder_alloc_mmap_handler: 16019 20005000-20009000 already mapped failed -16
[ 1859.292178] binder: BINDER_SET_CONTEXT_MGR already set
[ 1859.297704] binder: 16019:16021 ioctl 40046207 0 returned -16
[ 1859.304936] binder: 16019:16023 got reply transaction with no transaction stack
[ 1859.313046] binder: release 16019:16020 transaction 992 out, still active
[ 1859.323089] binder: send failed reply for transaction 992, target dead
[ 1859.536225] binder: 15980:16030 Acquire 1 refcount change on invalid ref 0 ret -22
14:05:48 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x48202, 0x0)
write$P9_ROPEN(r1, &(0x7f00000000c0)={0x18, 0x71, 0x1, {{0x80, 0x2, 0x3}, 0x5}}, 0x18)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

14:05:48 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf00]}, 0x2c)

14:05:48 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000), 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:48 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0xc, 0x0, &(0x7f0000000000)=[@acquire, @enter_looper], 0x41, 0x3f00, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

14:05:48 executing program 5:
socket$inet_udp(0x2, 0x2, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22}, 0x1c)
listen(r1, 0x0)
sendto$inet6(r0, &(0x7f0000000040), 0x0, 0x20000004, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @loopback, 0x4}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000080)='tls\x00', 0x152)
setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000100), 0x28)
sendto$inet6(r0, &(0x7f00000005c0), 0x263e90, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x0, @remote}, 0x1c)

14:05:48 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400101c0]})

[ 1859.710760] TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies.  Check SNMP counters.
14:05:48 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1100]}, 0x2c)

14:05:48 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x410101c0]})

14:05:48 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1200]}, 0x2c)

14:05:48 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48000000]})

14:05:49 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1300]}, 0x2c)

14:05:49 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1400]}, 0x2c)

[ 1860.471180] binder: BINDER_SET_CONTEXT_MGR already set
[ 1860.471306] binder_alloc: binder_alloc_mmap_handler: 16033 20005000-20009000 already mapped failed -16
[ 1860.514525] binder: 16033:16069 ioctl 40046207 0 returned -16
[ 1860.514564] binder: release 16038:16044 transaction 1001 out, still active
[ 1860.540099] binder: 16069 RLIMIT_NICE not set
[ 1860.548517] binder_release_work: 1 callbacks suppressed
[ 1860.548522] binder: undelivered TRANSACTION_COMPLETE
14:05:49 executing program 1:
r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300)='/dev/kvm\x00', 0x0, 0x0)
r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0)
r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0)
ioctl$KVM_ENABLE_CAP_CPU(r2, 0x4008ae89, &(0x7f00000000c0)={0x7b, 0x600000000000000, [0x40000082], [0xc2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x49000000]})

14:05:49 executing program 2:
bpf$MAP_CREATE(0x0, &(0x7f0000000040)={0x15, 0x10, 0xc6, 0x0, 0x4, 0xffffffffffffffff, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1500]}, 0x2c)

14:05:49 executing program 0:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(0x0, 0x0, 0x24)
mmap(&(0x7f0000005000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x1, 0x0, &(0x7f0000000040)="ea"})

[ 1860.559373] binder: send failed reply for transaction 999 to 16033:16034
[ 1860.600113] binder: send failed reply for transaction 1001, target dead
[ 1860.629578] binder: send failed reply for transaction 1002 to 16041:16042
14:05:49 executing program 3:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000580)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000), 0x41, 0x0, &(0x7f0000000040)="ea33e790ccab13d68f575dcee2bb127a2b3a0e3c96dc461dcedadfa221da40b646397fc20e00970734dc80f4900d86ad5ea53a6cfec4d4cb3a03c70e7f19bb04c8"})

[ 1860.654701] binder: undelivered TRANSACTION_COMPLETE
[ 1860.664674] binder_transaction: 20 callbacks suppressed
[ 1860.664691] binder: 16079:16080 transaction failed 29189/-3, size 0-0 line 3035
[ 1860.709349] binder: BINDER_SET_CONTEXT_MGR already set
[ 1860.735870] binder: 16079:16082 ioctl 40046207 0 returned -16
[ 1860.740321] binder: 16083:16084 transaction failed 29189/-3, size 0-0 line 3035
[ 1860.763889] binder: 16079:16080 transaction failed 29189/-3, size 0-0 line 3035
[ 1860.777711] binder_release_work: 22 callbacks suppressed
[ 1860.777718] binder: undelivered TRANSACTION_ERROR: 29189
[ 1860.882556] binder: undelivered TRANSACTION_ERROR: 29189
[ 1863.392458] device hsr_slave_1 left promiscuous mode
[ 1863.435003] device hsr_slave_0 left promiscuous mode
[ 1863.484341] team0 (unregistering): Port device team_slave_1 removed
[ 1863.495077] team0 (unregistering): Port device team_slave_0 removed
[ 1863.505514] bond0 (unregistering): Releasing backup interface bond_slave_1
[ 1863.573684] bond0 (unregistering): Releasing backup interface bond_slave_0
[ 1863.656827] bond0 (unregistering): Released all slaves
[ 2016.589737] INFO: task syz-executor.5:16032 blocked for more than 140 seconds.
[ 2016.597134]       Not tainted 5.0.0-rc8 #87
[ 2016.601560] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[ 2016.609560] syz-executor.5  D28224 16032   7506 0x00000004
[ 2016.615177] Call Trace:
[ 2016.617754]  __schedule+0x817/0x1cc0
[ 2016.621545]  ? pci_mmcfg_check_reserved+0x170/0x170
[ 2016.626666]  ? debug_smp_processor_id+0x1c/0x20
[ 2016.631395]  ? perf_trace_lock+0xeb/0x510
[ 2016.635544]  ? mark_held_locks+0x100/0x100
[ 2016.639819]  schedule+0x92/0x180
[ 2016.643188]  schedule_timeout+0x8ca/0xfd0
[ 2016.647319]  ? wait_for_completion+0x294/0x440
[ 2016.651968]  ? find_held_lock+0x35/0x130
[ 2016.656028]  ? usleep_range+0x170/0x170
[ 2016.660048]  ? mark_held_locks+0xb1/0x100
[ 2016.664203]  ? _raw_spin_unlock_irq+0x28/0x90
[ 2016.668687]  ? wait_for_completion+0x294/0x440
[ 2016.673450]  ? _raw_spin_unlock_irq+0x28/0x90
[ 2016.678158]  ? lockdep_hardirqs_on+0x415/0x5d0
[ 2016.682810]  ? trace_hardirqs_on+0x67/0x230
[ 2016.687132]  ? kasan_check_read+0x11/0x20
[ 2016.691355]  wait_for_completion+0x29c/0x440
[ 2016.695765]  ? wait_for_completion_interruptible+0x4b0/0x4b0
[ 2016.701624]  ? wake_up_q+0x100/0x100
[ 2016.705335]  ? mark_held_locks+0xb1/0x100
[ 2016.709555]  ? kfree+0x173/0x230
[ 2016.712932]  ? tls_sk_proto_close+0x664/0x760
[ 2016.717425]  tls_sw_free_resources_tx+0x3bc/0xa20
[ 2016.722322]  tls_sk_proto_close+0x66c/0x760
[ 2016.726657]  ? tcp_check_oom+0x560/0x560
[ 2016.730787]  ? tls_push_pending_closed_record+0x120/0x120
[ 2016.736322]  ? ip_mc_drop_socket+0x20c/0x270
[ 2016.740794]  ? __sock_release+0x89/0x250
[ 2016.744859]  inet_release+0x105/0x1f0
[ 2016.748650]  inet6_release+0x53/0x80
[ 2016.752419]  __sock_release+0xd3/0x250
[ 2016.756312]  ? __sock_release+0x250/0x250
[ 2016.760521]  sock_close+0x1b/0x30
[ 2016.764061]  __fput+0x2df/0x8d0
[ 2016.767329]  ____fput+0x16/0x20
[ 2016.770676]  task_work_run+0x14a/0x1c0
[ 2016.774565]  exit_to_usermode_loop+0x273/0x2c0
[ 2016.779146]  do_syscall_64+0x52d/0x610
[ 2016.783074]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[ 2016.788259] RIP: 0033:0x411d31
[ 2016.791501] Code: eb be 4c 8b 44 24 40 48 8b 54 24 48 e9 65 ff ff ff 48 8b 4c 24 58 e9 78 ff ff ff 48 8b 44 24 38 48 8b 4c 24 58 e9 69 ff ff ff <e8> 1a 82 04 00 e9 c5 fe ff ff cc cc cc cc cc 48 83 ec 20 48 89 6c
[ 2016.810437] RSP: 002b:0000000000a4fd90 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[ 2016.818140] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000411d31
[ 2016.825452] RDX: 0000000000000000 RSI: 0000000000740a28 RDI: 0000000000000004
[ 2016.832814] RBP: 0000000000000000 R08: 00000000d438a52a R09: 00000000d438a52e
[ 2016.840139] R10: 0000000000a4fcc0 R11: 0000000000000293 R12: 0000000000000000
[ 2016.847406] R13: 0000000000000001 R14: 00000000000010ed R15: 0000000000000005
[ 2016.854755] 
[ 2016.854755] Showing all locks held in the system:
[ 2016.861109] 1 lock held by khungtaskd/1040:
[ 2016.865642]  #0: 00000000e722ea50 (rcu_read_lock){....}, at: debug_show_all_locks+0x5f/0x27e
[ 2016.874320] 1 lock held by rsyslogd/7362:
[ 2016.878457]  #0: 0000000096341fa2 (&f->f_pos_lock){+.+.}, at: __fdget_pos+0xee/0x110
[ 2016.886420] 2 locks held by getty/7452:
[ 2016.890435]  #0: 00000000cfd60fe3 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
[ 2016.898681]  #1: 00000000824613ae (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70
[ 2016.907583] 2 locks held by getty/7453:
[ 2016.911588]  #0: 000000004771bc71 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
[ 2016.919879]  #1: 0000000091080070 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70
[ 2016.928732] 2 locks held by getty/7454:
[ 2016.932737]  #0: 0000000075f5b6e4 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
[ 2016.941015]  #1: 00000000ee69bc78 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70
[ 2016.949939] 2 locks held by getty/7455:
[ 2016.953909]  #0: 00000000f6233c0c (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
[ 2016.962335]  #1: 0000000000b0a80e (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70
[ 2016.971230] 2 locks held by getty/7456:
[ 2016.975185]  #0: 00000000360b2f23 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
[ 2016.983491]  #1: 00000000c2022637 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70
[ 2016.992422] 2 locks held by getty/7457:
[ 2016.996382]  #0: 00000000f20a5177 (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
[ 2017.004668]  #1: 000000002e8edd11 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70
[ 2017.013580] 2 locks held by getty/7458:
[ 2017.017535]  #0: 00000000b75a131a (&tty->ldisc_sem){++++}, at: ldsem_down_read+0x33/0x40
[ 2017.025928]  #1: 000000009f6e2ba0 (&ldata->atomic_read_lock){+.+.}, at: n_tty_read+0x232/0x1b70
[ 2017.034870] 1 lock held by kworker/u4:7/9677:
[ 2017.039359]  #0: 000000003c7ebc3b (&rq->lock){-.-.}, at: __schedule+0x1fc/0x1cc0
[ 2017.046973] 2 locks held by syz-executor.5/16032:
[ 2017.051858]  #0: 00000000bf59ca48 (&sb->s_type->i_mutex_key#11){+.+.}, at: __sock_release+0x89/0x250
[ 2017.061215]  #1: 0000000020d7e2ea (sk_lock-AF_INET6){+.+.}, at: tls_sk_proto_close+0xd6/0x760
[ 2017.069942] 
[ 2017.071565] =============================================
[ 2017.071565] 
[ 2017.078560] NMI backtrace for cpu 1
[ 2017.082221] CPU: 1 PID: 1040 Comm: khungtaskd Not tainted 5.0.0-rc8 #87
[ 2017.088966] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 2017.098300] Call Trace:
[ 2017.100875]  dump_stack+0x172/0x1f0
[ 2017.104486]  nmi_cpu_backtrace.cold+0x63/0xa4
[ 2017.108984]  ? lapic_can_unplug_cpu.cold+0x38/0x38
[ 2017.113906]  nmi_trigger_cpumask_backtrace+0x1be/0x236
[ 2017.119187]  arch_trigger_cpumask_backtrace+0x14/0x20
[ 2017.124366]  watchdog+0x9df/0xee0
[ 2017.127811]  kthread+0x357/0x430
[ 2017.131177]  ? reset_hung_task_detector+0x30/0x30
[ 2017.136015]  ? kthread_cancel_delayed_work_sync+0x20/0x20
[ 2017.141547]  ret_from_fork+0x3a/0x50
[ 2017.145377] Sending NMI from CPU 1 to CPUs 0:
[ 2017.150279] NMI backtrace for cpu 0
[ 2017.150285] CPU: 0 PID: 12624 Comm: kworker/0:0 Not tainted 5.0.0-rc8 #87
[ 2017.150291] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 2017.150294] Workqueue: events_power_efficient gc_worker
[ 2017.150301] RIP: 0010:find_held_lock+0x12/0x130
[ 2017.150311] Code: 4c 89 f7 48 89 75 d0 e8 7c 5e 50 00 48 8b 75 d0 e9 15 fd ff ff 0f 1f 00 55 48 89 e5 41 57 44 8d 7a ff 41 56 49 89 f6 49 63 c7 <41> 55 48 8d 04 80 41 54 4c 8d a4 c7 80 08 00 00 53 89 d3 48 83 ec
[ 2017.150314] RSP: 0018:ffff88808b7ffb60 EFLAGS: 00000002
[ 2017.150321] RAX: 0000000000000003 RBX: 1ffff110116fff76 RCX: ffff88808b7ffbd0
[ 2017.150326] RDX: 0000000000000004 RSI: ffffffff895d1d08 RDI: ffff888053b18680
[ 2017.150331] RBP: ffff88808b7ffb70 R08: ffff888053b18680 R09: 0000000000000004
[ 2017.150336] R10: ffff888053b18f78 R11: 0000000000000001 R12: ffffffff895d1d08
[ 2017.150340] R13: ffffffff814a827e R14: ffffffff895d1d08 R15: 0000000000000003
[ 2017.150345] FS:  0000000000000000(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000
[ 2017.150350] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2017.150354] CR2: 000000c431f6f5f0 CR3: 0000000098671000 CR4: 00000000001406f0
[ 2017.150359] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 2017.150364] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 2017.150367] Call Trace:
[ 2017.150370]  lock_release+0x262/0xa00
[ 2017.150373]  ? lock_downgrade+0x810/0x810
[ 2017.150377]  ? lock_acquire+0x16f/0x3f0
[ 2017.150380]  ? process_one_work+0x98e/0x1790
[ 2017.150383]  gc_worker+0x27f/0xea0
[ 2017.150387]  ? process_one_work+0x98e/0x1790
[ 2017.150391]  ? init_conntrack.isra.0+0x1180/0x1180
[ 2017.150395]  ? rcu_lockdep_current_cpu_online+0xe3/0x130
[ 2017.150398]  process_one_work+0x98e/0x1790
[ 2017.150402]  ? pwq_dec_nr_in_flight+0x320/0x320
[ 2017.150405]  ? lock_acquire+0x16f/0x3f0
[ 2017.150408]  worker_thread+0x98/0xe40
[ 2017.150412]  ? trace_hardirqs_on+0x67/0x230
[ 2017.150415]  kthread+0x357/0x430
[ 2017.150418]  ? process_one_work+0x1790/0x1790
[ 2017.150423]  ? kthread_cancel_delayed_work_sync+0x20/0x20
[ 2017.150426]  ret_from_fork+0x3a/0x50
[ 2017.151019] Kernel panic - not syncing: hung_task: blocked tasks
[ 2017.357890] CPU: 1 PID: 1040 Comm: khungtaskd Not tainted 5.0.0-rc8 #87
[ 2017.364736] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[ 2017.374077] Call Trace:
[ 2017.376666]  dump_stack+0x172/0x1f0
[ 2017.380284]  panic+0x2cb/0x65c
[ 2017.383461]  ? __warn_printk+0xf3/0xf3
[ 2017.387335]  ? lapic_can_unplug_cpu.cold+0x38/0x38
[ 2017.392251]  ? ___preempt_schedule+0x16/0x18
[ 2017.396657]  ? nmi_trigger_cpumask_backtrace+0x19e/0x236
[ 2017.402109]  ? nmi_trigger_cpumask_backtrace+0x1fa/0x236
[ 2017.407553]  ? nmi_trigger_cpumask_backtrace+0x204/0x236
[ 2017.412992]  ? nmi_trigger_cpumask_backtrace+0x19e/0x236
[ 2017.418446]  watchdog+0x9f0/0xee0
[ 2017.421895]  kthread+0x357/0x430
[ 2017.425246]  ? reset_hung_task_detector+0x30/0x30
[ 2017.430071]  ? kthread_cancel_delayed_work_sync+0x20/0x20
[ 2017.435616]  ret_from_fork+0x3a/0x50
[ 2017.440839] Kernel Offset: disabled
[ 2017.444525] Rebooting in 86400 seconds..