ge_slave_0: link becomes ready
[  362.684595] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  362.705577] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  362.716731] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  362.724219] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  363.089707] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  363.187416] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  363.193542] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  363.200885] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  363.382272] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  363.487955] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  363.494113] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  363.501358] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  364.011025] device lo entered promiscuous mode
[  364.019178] device lo left promiscuous mode
[  364.363552] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  364.419306] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  364.426213] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  364.436592] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  364.542239] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  364.597565] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  364.603678] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  364.611273] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  364.861934] binder_alloc: 4678: binder_alloc_buf failed to map page at 20001000 in userspace
[  364.870882] binder: 4678:4680 transaction failed 29201/-12, size 0-0 line 3136
[  364.881952] binder: BINDER_SET_CONTEXT_MGR already set
[  364.888104] binder_alloc: 4678: binder_alloc_buf, no vma
[  364.893650] binder: 4678:4680 ioctl 40046207 0 returned -16
[  364.899759] binder: 4678:4684 transaction failed 29189/-3, size 0-0 line 3136
[  364.907702] binder: undelivered TRANSACTION_ERROR: 29201
03:35:32 executing program 7:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000028c0)={{{@in6=@loopback, @in=@remote}}, {{@in6=@mcast1}, 0x0, @in=@multicast2}}, &(0x7f0000000400)=0xe8)
getgid()

03:35:32 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
getsockopt$inet6_buf(r0, 0x29, 0x32, &(0x7f0000000540)=""/4096, &(0x7f0000000000)=0x1000)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:35:32 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
setsockopt$inet_mreq(r0, 0x0, 0x23, &(0x7f0000000000)={@multicast2, @multicast2}, 0x8)

[  364.935396] binder: undelivered TRANSACTION_ERROR: 29189
[  364.961449] device lo entered promiscuous mode
[  364.969368] binder_alloc: 4703: binder_alloc_buf failed to map page at 20001000 in userspace
[  364.978049] device lo left promiscuous mode
[  364.983248] device lo left promiscuous mode
[  364.986122] device lo entered promiscuous mode
[  364.987875] device lo entered promiscuous mode
[  364.992516] device lo left promiscuous mode
[  364.997508] device lo left promiscuous mode
[  365.016829] binder: 4703:4706 transaction failed 29201/-12, size 0-0 line 3136
03:35:32 executing program 4:
r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
perf_event_open(&(0x7f0000001f88)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000fff)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000bf0000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
exit(0x0)
r1 = epoll_create1(0x0)
epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040))

03:35:32 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(0xffffffffffffffff, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:35:32 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
ioctl$TUNSETSNDBUF(r2, 0x400454d4, &(0x7f0000000200)=0xbb21)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="030000000000000008001b0000000000ee61d17102d7ac14f729a2200969b34860fad8dd9d92438438781ec49736c8277a6d753d086d18a9fb8308dd20d566f2bd8b1b866291c5116de22754c74fa405f55aeb66d914b50feffcea43f76233082fe2aa301d7261defade4f06958d01a87e6f8a085d5498e36d3fad990d55d5eb6bd475b995cfb25f137224aaf8a4e8a7eebd2a29739b0321520f710f02a0f004a65e8980f17cb01741bd603d8e449fe334ba589587bc8ff330c0717110a751f68214a12acb28d4c35771fb2b2551e6ef321b9488f89ceba69a46756085c4879ef7c9"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:35:32 executing program 6:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4)
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getsockname$inet(r0, &(0x7f0000000100)={0x2, 0x0, @rand_addr}, &(0x7f0000000180)=0x10)
ioctl$int_in(r0, 0x5452, &(0x7f0000000380)=0x3)
sendto$inet(r0, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10)
sendto$inet(r0, &(0x7f0000000000), 0xff6c, 0x0, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10)
socket$inet6_udp(0xa, 0x2, 0x0)

03:35:32 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:35:32 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
fchmod(r0, 0x100)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'lo\x00@\x00', 0x4000})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000040), 0x4)

03:35:32 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x80ffc)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:35:32 executing program 7:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000028c0)={{{@in6=@loopback, @in=@remote}}, {{@in6=@mcast1}, 0x0, @in=@multicast2}}, &(0x7f0000000400)=0xe8)
getgid()

[  365.075810] binder: undelivered TRANSACTION_ERROR: 29201
03:35:32 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$packet_buf(r0, 0x107, 0x5, &(0x7f0000000000)="b40c984422a65d06963653c8eb544be51e6b0f64275554825d61c4", 0x1b)
r1 = creat(&(0x7f0000000040)='./file0\x00', 0x30)
ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f00000000c0)=""/37)
getsockname(r0, &(0x7f0000000100)=@pppoe={0x18, 0x0, {0x0, @random}}, &(0x7f00000001c0)=0x80)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'lo\x00@\x00', 0x1200})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:35:33 executing program 1:
r0 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000)
ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f00000001c0)={0xfffffffffffffff7, {0x2, 0x4e23, @multicast2}, {0x2, 0x4e24, @broadcast}, {0x2, 0x4e24, @rand_addr=0xd5aa}, 0x4, 0xfffffffffffffffb, 0x4, 0x5, 0x100000000, &(0x7f0000000140)='bridge_slave_1\x00', 0xffffffff7fffffff, 0x27d, 0x1})
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
ioctl$sock_SIOCDELDLCI(r1, 0x8981, &(0x7f0000000000)={'bcsh0\x00', 0x10000})
r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x2, 0x0)
getsockname$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}, &(0x7f0000000100)=0x1c)

[  365.146672] device lo entered promiscuous mode
[  365.153059] binder_alloc: 4729: binder_alloc_buf failed to map page at 20001000 in userspace
[  365.166521] device lo left promiscuous mode
[  365.172487] binder: 4729:4733 transaction failed 29201/-12, size 0-0 line 3136
[  365.184718] device lo entered promiscuous mode
[  365.200617] device lo left promiscuous mode
[  365.220649] device lo entered promiscuous mode
[  365.235053] device lo left promiscuous mode
03:35:33 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:35:33 executing program 7:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000028c0)={{{@in6=@loopback, @in=@remote}}, {{@in6=@mcast1}, 0x0, @in=@multicast2}}, &(0x7f0000000400)=0xe8)
getgid()

03:35:33 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
r1 = open(&(0x7f0000000000)='./file0\x00', 0x83058d55bf30f73, 0x60)
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r1, 0xc0605345, &(0x7f0000000040)={0x580, 0x1, {0x0, 0x0, 0x0, 0x2, 0xefe}})

[  365.256097] binder: undelivered TRANSACTION_ERROR: 29201
[  365.312071] binder_alloc: 4761: binder_alloc_buf failed to map page at 20001000 in userspace
[  365.326749] binder: 4761:4763 transaction failed 29201/-12, size 0-0 line 3136
[  365.349879] device lo entered promiscuous mode
[  365.356425] device lo left promiscuous mode
03:35:33 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x5, 0x10000)
ioctl$KDDISABIO(r1, 0x4b37)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:35:33 executing program 7:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000028c0)={{{@in6=@loopback, @in=@remote}}, {{@in6=@mcast1}, 0x0, @in=@multicast2}}, &(0x7f0000000400)=0xe8)

[  365.364564] device lo entered promiscuous mode
[  365.365520] binder: undelivered TRANSACTION_ERROR: 29201
[  365.386079] device lo left promiscuous mode
[  365.400352] device lo entered promiscuous mode
[  365.404302] binder_alloc: 4774: binder_alloc_buf failed to map page at 20001000 in userspace
03:35:33 executing program 7:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  365.404974] binder: 4774:4776 transaction failed 29201/-12, size 0-0 line 3136
[  365.425995] device lo entered promiscuous mode
[  365.426675] binder: undelivered TRANSACTION_ERROR: 29201
[  365.444501] device lo left promiscuous mode
[  365.451532] device lo left promiscuous mode
[  365.457775] device lo entered promiscuous mode
[  365.464408] device lo left promiscuous mode
[  365.486611] binder_alloc: 4778: binder_alloc_buf failed to map page at 20001000 in userspace
[  365.502340] binder: 4778:4779 transaction failed 29201/-12, size 0-0 line 3136
[  365.535450] binder: undelivered TRANSACTION_ERROR: 29201
03:35:33 executing program 4:
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
bind$inet(r1, &(0x7f000099e000)={0x2, 0x4e20, @multicast1}, 0x10)
sendto$inet(r1, &(0x7f0000000200), 0xfffffffffffffeb4, 0x20008005, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback}, 0x10)
syz_open_procfs(0x0, &(0x7f0000000300)='schedstat\x00')
recvfrom(r1, &(0x7f0000f9cf9b)=""/101, 0x6478c8501c739c9d, 0x120, 0x0, 0x35)
sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYRES16], 0x1}}, 0x0)

03:35:33 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0x4000})
syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f0000000100)='./file0\x00', 0xfffffffffffffff7, 0x6, &(0x7f00000004c0)=[{&(0x7f00000001c0)="eec3ce9c28a9797165c481ad693d22cfcfc2cc45cfe52d9bdcf4fb66386de7752d97d4c4c6fea1a406eb756da2d784affd244ac4c1ecbacbbf0543bf703e7fb57806ce0db8fe8af5f9fb41057dbc55442aa235da1e78ca6a2ab28b34abd116a92c5719c6739a878051824749e326ec4889d7af16375c", 0x76}, {&(0x7f0000000240)="61bc19419f3217f2d8529bc952a38ec0a303f8d982761360701f8cf8238003c1747c15cabf59cf482032d76c9a1dc9e50b6a81f26337b5fa82ad996e48f3113a4efbb967b3a94f69a6fd62196aa76b63b8b172ce7a6c98ad4adc719f25f59403154649eb36aa8be3a6ce51ec9aeb2e32f85824c83f9e0bfadce458c95118b6aa0eb04476642968d48847fafee975a771fbf599171343471d07a31895b86f9d4f63", 0xa1, 0x4}, {&(0x7f0000000140)="1fa7551b2b6f3953acb00b0fa76afa824170011547a70b3d74e65514e2faa42f3402b1b5ca1f519ce19cfc", 0x2b, 0x1000}, {&(0x7f0000000300)="81e87814af4e9dc1dffba231386c2ee6641fb510d1f643", 0x17, 0x7}, {&(0x7f0000000340)="7b8a7371275b8c216357aad5ece57d12cb0548988a3e8b7a51ca1c9eb0ef386ae66571aca1900e428367c5547f4ec4584f20a57d5b311aa02a7bb3761c6c4bc0f3c9b2cecd73b5cc74f966efbe0377162223d62f4ded5b648ee4a8f5fcf454647050ca2415f553a5fcf1845f6693d36a9126c939e154aabedd2bd43037094471a1defc2b18162041eb45da0b5f5409a030bc196d9d8dde46410981f698c07fcf9eba50b21e702cda5ecccc550b4dfde999db0670b4", 0xb5, 0x100}, {&(0x7f0000000400)="5960af129b57f961629aef7b4669478ade433d5a90a51a0961f8c6dadfdfcc1b7f4eac68829a67741dc29d6bac637397bfa4d842dc9189e6adfac2198bbf91aebe6e7608515c824014b07609632a852603d3737b7a2c187712d1f9c33bdc59d3103041d4b7c0145890824aeb9049d217b6bd4523e5ef67a59dd213c040bc097f22849f76c7eb0fa80dbc4f4bfb915da3748512338d50332050bbffb09be6af7895b38d4e7e783094fb8ffdc54bfde9952e0c473cc3ec9376b9831449", 0xbc, 0x40d}], 0x10020, &(0x7f0000000580)={[{@dax='dax'}, {@init_itable_val={'init_itable', 0x3d, 0x6}}, {@nodiscard='nodiscard'}, {@debug='debug'}]})
ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f0000000040)=@req={0x28, &(0x7f0000000000)={'veth0_to_bridge\x00', @ifru_names='veth0_to_bond\x00'}})

03:35:33 executing program 5:
seccomp(0x0, 0x1, &(0x7f0000000040)={0x2, &(0x7f0000000080)=[{0x6, 0xc8, 0x5, 0x7f}, {0x94b0, 0x6, 0xffffffff}]})
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={'bond0\x00'})

03:35:33 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={'v\x00', 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x200, 0x0)
ioctl$SG_GET_RESERVED_SIZE(r4, 0x2272, &(0x7f00000002c0))
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r5 = syz_open_procfs(0x0, &(0x7f0000000200)='mountinfo\x00')
ioctl$SG_GET_RESERVED_SIZE(r4, 0x2272, &(0x7f0000000300))
ioctl$LOOP_SET_FD(r0, 0x4c00, r5)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:35:33 executing program 7:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:35:33 executing program 6:
r0 = socket(0x40000000002, 0x3, 0x2)
setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='ip6tnl0\x00', 0x10)
setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000180)=0x830, 0x4)
sendto$unix(r0, &(0x7f0000000080), 0x7272, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0x10000e0}, 0x6e)
readv(0xffffffffffffffff, &(0x7f0000000500), 0x0)

03:35:33 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(0xffffffffffffffff, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:35:33 executing program 6:
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200)
r1 = socket$inet6(0xa, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000))
r2 = socket$inet6(0xa, 0x2, 0x0)
ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}})
setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@remote, @rand_addr}, 0x6)
setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000000040)=ANY=[], 0x0)
close(r2)
dup3(r1, 0xffffffffffffffff, 0x0)

[  365.972907] device lo entered promiscuous mode
[  365.990495] binder: 4795:4799 transaction failed 29189/-22, size 0-0 line 3013
[  366.000300] device lo entered promiscuous mode
03:35:33 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000040), &(0x7f0000000080)=0x8)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'lo\x00@\x00', 0x101})
r1 = accept4$packet(0xffffffffffffff9c, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14, 0x80000)
setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000140)=@req={0x5, 0x8, 0x5, 0x20}, 0x10)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0x400000})

[  366.015242] device lo left promiscuous mode
[  366.059822] device lo entered promiscuous mode
03:35:33 executing program 6:
r0 = socket$inet6(0xa, 0x80002, 0x88)
connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @local}, 0x1c)
sendto$inet6(r0, &(0x7f0000000300), 0x0, 0x400806e, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @mcast1}, 0x1c)
sendto$inet6(r0, &(0x7f0000000240)="d6", 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote}, 0x1c)

[  366.076537] device lo left promiscuous mode
[  366.125878] device lo entered promiscuous mode
[  366.145791] device lo left promiscuous mode
[  366.165726] binder: undelivered TRANSACTION_ERROR: 29189
[  366.184058] device lo entered promiscuous mode
[  368.389395] IPVS: Creating netns size=2536 id=82
[  368.560361] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  368.573690] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  368.630444] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  368.644130] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  368.699857] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  368.713368] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  368.727909] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  368.742699] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  369.390747] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  369.426186] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  369.432294] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  369.439591] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:35:38 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:35:38 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r1 = dup3(r0, r0, 0x80000)
setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000000)="a1959ce24c1ee1996c1b1faa97da9ec9", 0x10)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:35:38 executing program 6:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000001400)={&(0x7f00000001c0), 0xc, &(0x7f00000013c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="14000000120005010000000000000000c5000000"], 0x1}}, 0x0)

03:35:38 executing program 7:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:35:38 executing program 4:
openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_user\x00', 0x0, 0x0)
mkdirat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x0)
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0)
syz_open_dev$sg(&(0x7f0000d08ff7)='/dev/sg#\x00', 0x0, 0x81)
r1 = gettid()
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000))
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000))
tkill(r1, 0x0)
close(r0)
setsockopt$IP_VS_SO_SET_STARTDAEMON(0xffffffffffffffff, 0x0, 0x13, &(0x7f0000000200)={0x0, 'bridge_slave_1\x00'}, 0x14)

03:35:38 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x104})
socket$inet6_udplite(0xa, 0x2, 0x88)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:35:38 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x402200, 0x0)
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280)={<r5=>0x0}, &(0x7f00000002c0)=0xc)
write$P9_RGETLOCK(r4, &(0x7f0000000300)={0x1f, 0x37, 0x1, {0x2, 0x74, 0x1, r5, 0x1, '@'}}, 0x1f)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r6 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r6)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:35:38 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(0xffffffffffffffff, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:35:38 executing program 6:
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000064c0))
add_key(&(0x7f0000000280)='asymmetric\x00', &(0x7f0000000300), &(0x7f0000000340)="fa", 0x1, 0xffffffffffffffff)
mkdir(&(0x7f0000000180)='./file1\x00', 0x0)
syz_mount_image$ext4(&(0x7f0000000100)='ext-\x00', &(0x7f0000000140)='./file1\x00', 0x8cffffff00000000, 0x0, &(0x7f0000001800), 0x820, &(0x7f0000000240))

03:35:38 executing program 7:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  370.484150] device lo left promiscuous mode
[  370.490759] binder: 5219:5229 transaction failed 29189/-22, size 0-0 line 3013
[  370.509780] device lo left promiscuous mode
[  370.515461] device lo entered promiscuous mode
03:35:38 executing program 6:
r0 = syz_open_procfs(0x0, &(0x7f0000000080)='oom_score_adj\x00')
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1, 0x18032, 0xffffffffffffffff, 0x0)
write$binfmt_misc(r0, &(0x7f0000000000)={'syz1'}, 0x4)

[  370.525631] binder: undelivered TRANSACTION_ERROR: 29189
[  370.563354] binder: 5242:5247 transaction failed 29189/-22, size 0-0 line 3013
[  370.575374] device lo entered promiscuous mode
[  370.584546] device lo left promiscuous mode
03:35:38 executing program 7:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:35:38 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0x400})
setsockopt$sock_int(r0, 0x1, 0x3, &(0x7f0000000040)=0xfff, 0x4)
syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x6f, 0x100)

03:35:38 executing program 4:
fremovexattr(0xffffffffffffffff, &(0x7f0000000100)=@known='security.ima\x00')
r0 = gettid()
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={&(0x7f00000002c0), &(0x7f00000003c0)}}, &(0x7f0000000280))
timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x1c9c380}, {0x0, 0x9}}, &(0x7f0000000200))
tkill(r0, 0x0)

[  370.602998] binder: undelivered TRANSACTION_ERROR: 29189
03:35:38 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:35:38 executing program 6:
r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0)
fchdir(r0)
mknod$loop(&(0x7f0000000440)='./file0\x00', 0x0, 0xffffffffffffffff)
unlink(&(0x7f00000004c0)='./file0\x00')

[  370.641781] device lo left promiscuous mode
[  370.684303] device lo entered promiscuous mode
[  370.696114] binder: release 5260:5267 transaction 27 out, still active
[  370.696119] binder: undelivered TRANSACTION_COMPLETE
[  370.701380] binder: send failed reply for transaction 27, target dead
03:35:38 executing program 4:
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000004c80)={{{@in6=@mcast1, @in6=@ipv4={[], [], @remote}}}, {{}, 0x0, @in=@multicast1}}, &(0x7f0000004d80)=0xe8)
add_key(&(0x7f0000000280)='asymmetric\x00', &(0x7f0000000300), &(0x7f0000000340)="fa", 0x1, 0xffffffffffffffff)

03:35:38 executing program 7:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:35:38 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:35:38 executing program 6:
r0 = socket$inet6(0xa, 0x3, 0x3a)
setsockopt$inet6_int(r0, 0x29, 0x2000000c8, &(0x7f0000000000), 0x4)
syz_emit_ethernet(0x66, &(0x7f00000000c0)={@random="2fd6b1be27a3", @remote, [], {@ipv6={0x86dd, {0x0, 0x6, "06f526", 0x30, 0x3a, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}, @mcast2={0xff, 0xffffff89}, {[], @icmpv6=@pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "0a07ec", 0x0, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}, @ipv4={[0xf5ffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @dev}}}}}}}}, &(0x7f0000000040))

03:35:38 executing program 1:
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x1, 0x0)
fremovexattr(r0, &(0x7f0000000280)=@random={'system.', 'syzkaller1\x00'})
r1 = dup2(0xffffffffffffffff, 0xffffffffffffff9c)
r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00')
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x800})
sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x18, r2, 0x0, 0x70bd29, 0x25dfdbfd, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x5}, 0x5)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
openat$cgroup_subtree(r1, &(0x7f00000001c0)='cgroup.subtree_control\x00', 0x2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:35:38 executing program 3:
r0 = syz_open_dev$usbmon(&(0x7f0000000200)='/dev/usbmon#\x00', 0x4, 0x8080)
ioctl$TUNDETACHFILTER(r0, 0x401054d6, 0x0)
r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r2 = syz_open_dev$loop(&(0x7f0000000580)='/dev/loop#\x00', 0x20000000000, 0x40080)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r4 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
ioctl$EVIOCGKEYCODE(r6, 0x80084504, &(0x7f0000000280)=""/162)
getsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f0000000400)={{{@in=@multicast2, @in6=@loopback}}, {{@in=@broadcast}, 0x0, @in6=@remote}}, &(0x7f0000000340)=0xe8)
r7 = socket$packet(0x11, 0x3, 0x300)
r8 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
fcntl$addseals(r7, 0x409, 0x3)
ioctl$LOOP_SET_FD(r1, 0x4c00, r8)
ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2)

[  370.741939] device lo entered promiscuous mode
[  370.756959] device lo left promiscuous mode
[  370.763412] device lo left promiscuous mode
03:35:38 executing program 6:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0x400})
setsockopt$sock_int(r0, 0x1, 0x3, &(0x7f0000000040)=0xfff, 0x4)
syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x6f, 0x100)

[  370.806580] binder: release 5286:5291 transaction 29 out, still active
[  370.813279] binder: undelivered TRANSACTION_COMPLETE
[  370.840925] device lo entered promiscuous mode
[  370.869936] binder: send failed reply for transaction 29, target dead
[  370.912806] device lo entered promiscuous mode
[  370.918924] device lo left promiscuous mode
[  370.924134] device lo entered promiscuous mode
[  370.933481] device lo left promiscuous mode
[  370.942381] device lo left promiscuous mode
[  370.986803] device lo entered promiscuous mode
03:35:39 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[], 0x0)

03:35:39 executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:35:39 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000280)={{{@in6=@local, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000380)=0xe8)
setsockopt$inet6_IPV6_PKTINFO(r2, 0x29, 0x32, &(0x7f0000000400)={@local, r3}, 0x14)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r5 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
ioctl$TIOCGPGRP(r6, 0x540f, &(0x7f0000000440))
getpgrp(0xffffffffffffffff)
ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000480))
r7 = gettid()
r8 = syz_open_procfs(r7, &(0x7f0000000580)="09002a22b4097866002a2399994efae04bf87f000000000000007791bef3bedc5f1c06004780c0e435210400000009000000000000002a27abd3eae72c1d5aac0000000000000000000000000000000000000000000000")
ioctl$LOOP_SET_FD(r0, 0x4c00, r8)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:35:39 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x5, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xcd, 0x6}, 0x40000000000000, 0x0, 0x0, 0xfffffffffffffffd, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r1 = socket$inet6(0xa, 0x400000000001, 0x0)
setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000280)={@in6={{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x1f, 0x0, "8c0eb7912a86ff3e23764a3c01af55410c3d3f813a4513a691be997c7ee1235982875b8ae5c27fc73eb383beca956b51a34191ad3a9f70ebee5f1d003dcd4427c273be993dd363cc8f36cc7f609a2371"}, 0xd8)
r2 = dup(r1)
setsockopt$inet6_tcp_int(r2, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4)
bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c)
sendto$inet6(r1, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
sendto$inet6(r1, &(0x7f0000000100)="12", 0x1, 0x80, &(0x7f0000000140)={0xa, 0x0, 0x0, @loopback}, 0x1c)
ioctl$BLKSECDISCARD(r0, 0x127d, &(0x7f0000000000)=0x4)
r3 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0)
ftruncate(r3, 0x7fff)
sendfile(r1, r3, &(0x7f0000000040), 0x8000ffffffee)
r4 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x4000000000101})
ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:35:39 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x8, 0x4031, r1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0x1})

03:35:39 executing program 7:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:35:39 executing program 4:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:35:39 executing program 7:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  371.299557] device lo left promiscuous mode
[  371.302710] binder: release 5324:5328 transaction 31 out, still active
[  371.302715] binder: undelivered TRANSACTION_COMPLETE
[  371.307304] binder: BINDER_SET_CONTEXT_MGR already set
[  371.307312] binder: 5323:5330 ioctl 40046207 0 returned -16
03:35:39 executing program 4:
seccomp(0x0, 0x1, &(0x7f0000000040)={0x2, &(0x7f0000000080)=[{0x6, 0xc8, 0x5, 0x7f}, {0x94b0, 0x6, 0xffffffff}]})
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={'bond0\x00'})

[  371.313677] binder: send failed reply for transaction 31, target dead
[  371.313686] binder: send failed reply for transaction 32 to 5323:5330
[  371.345489] binder: undelivered TRANSACTION_COMPLETE
[  371.345497] binder: undelivered TRANSACTION_ERROR: 29189
[  371.388188] device lo entered promiscuous mode
03:35:39 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000040))
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

[  371.398653] binder_alloc: 5334: binder_alloc_buf, no vma
[  371.405054] binder: 5334:5335 transaction failed 29189/-3, size 0-0 line 3136
[  371.405809] device lo entered promiscuous mode
[  371.405874] device lo left promiscuous mode
[  371.438332] device lo entered promiscuous mode
[  371.438611] device lo left promiscuous mode
[  371.457133] device lo entered promiscuous mode
[  371.461356] device lo entered promiscuous mode
[  371.468446] device lo left promiscuous mode
[  371.545487] binder: undelivered TRANSACTION_ERROR: 29189
[  372.568850] IPVS: Creating netns size=2536 id=83
[  372.813432] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  372.827128] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  373.261333] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  373.275588] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  373.332246] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  373.347077] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  373.361136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  373.375896] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  374.153933] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  374.190786] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  374.196954] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  374.203624] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:35:43 executing program 7:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:35:43 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x44fd, 0x0)
openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x80000, 0x0)
renameat(r0, &(0x7f0000000000)='./file0\x00', r1, &(0x7f0000000080)='./file0\x00')

03:35:43 executing program 4:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x80ffc)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:35:43 executing program 6:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x200, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:35:43 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:35:43 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[], 0x0)

03:35:43 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'veth1\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
bind(r0, &(0x7f0000000000)=@pppoe={0x18, 0x0, {0x4, @broadcast, 'team0\x00'}}, 0x80)
r1 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x34, 0x0)
ioctl$UI_SET_MSCBIT(r1, 0x40045568, 0x8)

03:35:43 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x81, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000340)='/dev/hwrng\x00', 0x400000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB="03000000000000002bbe5d03e9e855357ce86d702c73fa6466f32221ca4ae13418bd2902dac21b5b35bafee421ca3d53"], 0x1}}, 0x0)
r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200)='/dev/hwrng\x00', 0x4040, 0x0)
getsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000280), 0x10)
socket$packet(0x11, 0x3, 0x300)
getsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@remote, @in=@multicast2}}, {{@in=@remote}, 0x0, @in6=@loopback}}, &(0x7f0000000300)=0xe8)
r7 = accept4$unix(r4, &(0x7f0000000500), &(0x7f0000000180)=0x6e, 0x800)
accept4(r7, &(0x7f0000000580)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f00000003c0)=0x80, 0x80000)
r8 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r8)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:35:43 executing program 7:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  375.266170] device lo left promiscuous mode
[  375.268864] binder_alloc: 5743: binder_alloc_buf, no vma
[  375.269009] binder: 5743:5748 transaction failed 29189/-3, size 0-0 line 3136
03:35:43 executing program 7:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  375.305853] binder: undelivered TRANSACTION_ERROR: 29189
[  375.334124] binder_alloc: 5756: binder_alloc_buf, no vma
[  375.334143] binder: 5756:5757 transaction failed 29189/-3, size 0-0 line 3136
[  375.360794] binder: undelivered TRANSACTION_ERROR: 29189
[  375.391373] binder: 5763:5766 transaction failed 29189/-22, size 0-0 line 3013
[  375.403534] device veth1 entered promiscuous mode
[  375.403988] device lo left promiscuous mode
03:35:43 executing program 7:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  375.495510] binder: undelivered TRANSACTION_ERROR: 29189
[  375.537073] binder: 5771:5772 transaction failed 29189/-22, size 0-0 line 3013
03:35:43 executing program 7:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  375.595430] binder: undelivered TRANSACTION_ERROR: 29189
[  375.632057] device lo entered promiscuous mode
[  375.636918] binder: 5774:5775 transaction failed 29189/-22, size 0-0 line 3013
03:35:43 executing program 5:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f0000000140)={'gre0\x00', {0x2, 0x4e23}})
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x800440040, 0x0)
getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f0000000240)=""/139, &(0x7f0000000040)=0x8b)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'bpq0\x00'})
ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x1)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:35:43 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x3, 0x8800)
ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0)

03:35:43 executing program 4:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = creat(&(0x7f0000000140)='./file0\x00', 0x4)
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x2, 0x0)
read$eventfd(r2, &(0x7f0000000040), 0x8)
ioctl$ASHMEM_GET_NAME(r1, 0x81007702, &(0x7f0000000240)=""/255)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000007ac0)={{{@in, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in=@multicast2}, 0x0, @in6}}, &(0x7f0000007bc0)=0xe8)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000007c00)={'team0\x00', r3})
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000080)={'syzkaller0\x00'})

03:35:43 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000001c0)={{{@in=@broadcast, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0}}, {{@in6=@loopback}, 0x0, @in=@dev}}, &(0x7f0000000000)=0xe8)
setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, [], 0x15}, @in6=@loopback, 0x4e22, 0x0, 0x4e21, 0xffffffffffffff01, 0x200000a, 0x20, 0x20, 0xbf, 0x0, r1}, {0x3, 0x5, 0x665f, 0x2, 0x8, 0x7, 0x8, 0x9}, {0xfff, 0x1, 0x6, 0xfffffffffffff9bc}, 0x200, 0x6e6bbe, 0x2, 0x1, 0x1, 0x2}, {{@in=@loopback, 0x4d5}, 0xa, @in6=@local, 0x3506, 0x4, 0x3, 0xffffffffffff4942, 0x9de, 0x1, 0x8}}, 0xe8)
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000080)={0x0, @empty, @broadcast}, &(0x7f0000000100)=0xc)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x0, 0x0)
mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x9, 0x10010, r2, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={'bridge0\x00'})
pipe(&(0x7f0000000040)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r3)

[  375.660841] device lo left promiscuous mode
[  375.718305] device lo entered promiscuous mode
[  375.724989] device lo left promiscuous mode
[  375.728753] device lo entered promiscuous mode
03:35:43 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

[  375.734807] device lo left promiscuous mode
[  375.756271] device lo entered promiscuous mode
[  375.760149] device lo left promiscuous mode
03:35:43 executing program 7:
perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  375.855710] binder: undelivered TRANSACTION_ERROR: 29189
03:35:43 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  375.954959] binder_alloc: 5803: binder_alloc_buf failed to map page at 20001000 in userspace
[  375.969286] binder: 5803:5805 transaction failed 29201/-12, size 0-0 line 3136
[  375.977970] binder: undelivered TRANSACTION_ERROR: 29201
[  376.027344] device lo entered promiscuous mode
[  376.033485] device lo entered promiscuous mode
[  376.041044] device lo entered promiscuous mode
[  376.048492] device lo left promiscuous mode
[  376.175481] IPVS: Creating netns size=2536 id=84
[  376.353296] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  376.367399] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  376.448367] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  376.462100] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  376.519316] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  376.532432] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  376.547579] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  376.562765] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  377.243410] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  377.277419] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  377.283523] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  377.291011] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  378.588774] IPVS: Creating netns size=2536 id=85
[  378.763248] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  378.777148] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  378.857707] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  378.871246] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  378.952336] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  378.967186] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  378.981153] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  378.996682] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  379.667486] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  379.701898] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  379.708261] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  379.714894] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:35:47 executing program 6:
mkdir(&(0x7f0000000000)='./file0\x00', 0x0)
pipe2$9p(&(0x7f0000000100)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x0)
write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0x7, 0x4d, 0x1fffffffffffc}, 0x7)
mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000006c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_u='version=9p2000.u'}]}})
write$P9_RREADDIR(r1, &(0x7f0000000480)=ANY=[@ANYBLOB="2a0000002901000000000000000000000000000000000000fe000000bc4f00000007002e2f66696c6530"], 0x2a)
write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0)
mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="81c8bf93852c7266646e6f3d000000", @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB=',nodevmap,\x00'])
ioctl$KIOCSOUND(r0, 0x4b2f, 0x4)
write$P9_RCLUNK(r1, &(0x7f0000000140)={0x7, 0x79, 0x2}, 0x7)
vmsplice(r0, &(0x7f0000000440)=[{&(0x7f0000000640)="ad2bb8c0df1f14bae6473b0ff3e8043d3ba2b766d05643f6e2e0b58a7941ac46e012d83c49a70362a4610b88c78ea0fff150245f1656d63a72f8ed4eca", 0x3d}], 0x1, 0x0)
socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f00000001c0)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
getsockopt$ARPT_SO_GET_ENTRIES(r2, 0x0, 0x61, &(0x7f00000005c0)=ANY=[], &(0x7f0000000400))
ioctl$RTC_ALM_SET(r2, 0x40247007, &(0x7f00000004c0)={0x35, 0x17, 0x6, 0x10, 0x0, 0x800, 0x5, 0x8f, 0xffffffffffffffff})
chmod(&(0x7f0000000500)='./file0/file0\x00', 0x0)

03:35:47 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:35:47 executing program 4:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x20, 0x0)
socket$inet(0x2, 0x3, 0x200)
r1 = getegid()
r2 = getegid()
setregid(r1, r2)
ioctl$BLKFLSBUF(r0, 0x1261, &(0x7f0000000080))

03:35:47 executing program 3:
times(&(0x7f0000000340))
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000180)={<r2=>0xffffffffffffffff})
ioctl$sock_SIOCBRDELBR(r2, 0x89a1, &(0x7f0000000300)='team_slave_0\x00')
r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000580)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r4 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/enforce\x00', 0x40000000008004, 0x0)
r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB="030000c1326bb40008001b000000207d0d3ca14b00b135ebc6b23e72cc0800000000000000169d9e36b5dc52157fa5695afcf4ade9923e30b3664c8a4f640c59acdeb14fd7d8fb02d51451a9e2d5b31517b082df2b7034c51d18e5cb4f069900000000000000041f494bfd7cc690fbbc75151ace13548a061c3451c8a8b2d6871879e3d68be62450c1bb6d719428ced5dd81057618cdb5ad563abda57c51e09d250dac1341557dae14d096047b7b7309fb32ba5b0b1bba1dde4069063e53c381e65495d991a32532e93d176097eb04d76c7038e200000000000000000000000000000000000000000000000023476f7a71a76cc9239f57b92d132c19da370ff71f31bb7ca15838f0e77c9204187e15b1dc29b2b527b3a749c7edc597a6ea2d5377539b6e5c58faea1b2064ef6eb3e9"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_threshold\x00', 0x2, 0x0)
r7 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r7)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000000280)={0x8, &(0x7f0000000200)=[{0x26a, 0x52, 0x3, 0x3}, {0x7ff, 0x1, 0x6a7, 0x7}, {0x1, 0x6, 0x899, 0x3}, {0x3, 0x1, 0x6}, {0x80, 0xc8a, 0x7fff, 0x3}, {0x8, 0x5, 0x100000000, 0x7}, {0x9, 0xa02, 0x9, 0xc70}, {0x1, 0x7b, 0x165, 0x3}]}, 0x10)
write$P9_RAUTH(r7, &(0x7f00000002c0)={0x14, 0x67, 0x2, {0x6f, 0x0, 0x8}}, 0x14)
ioctl$SNDRV_TIMER_IOCTL_PARAMS(r5, 0x40505412, &(0x7f0000000400)={0x5, 0x2, 0x2000000000, 0x0, 0x7})

03:35:47 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[], 0x0)

03:35:47 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000000080)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'lo\x00@\x00', 0x105})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:35:47 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$inet_int(r0, 0x0, 0x3f, &(0x7f0000000000), &(0x7f0000000040)=0x4)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:35:47 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
close(0xffffffffffffffff)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

[  379.986559] device lo entered promiscuous mode
[  379.993424] device lo left promiscuous mode
03:35:47 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  380.061776] 9pnet_virtio: no channels available for device (null)
[  380.071928] binder_alloc: 6566: binder_alloc_buf, no vma
03:35:47 executing program 4:
r0 = socket$packet(0x11, 0x3, 0x300)
setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000340)=0x3, 0x4)
sendto$inet6(r0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x2000000000d, @mcast2}, 0x1c)

[  380.071944] binder: 6566:6573 transaction failed 29189/-3, size 0-0 line 3136
03:35:48 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/create\x00', 0x2, 0x0)
setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f00000001c0)={'filter\x00', 0x7, 0x4, 0x478, 0x138, 0x0, 0x138, 0x390, 0x390, 0x390, 0x4, &(0x7f0000000000), {[{{@uncond, 0xf0, 0x138}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xca4, 'syz0\x00', 0x200}}}, {{@uncond, 0xf0, 0x118}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x800, 0x7}}}, {{@arp={@broadcast, @loopback, 0x0, 0xff000000, @mac=@remote, {[0xff, 0xff]}, @empty, {[0xff, 0xff, 0xff, 0xff, 0xff]}, 0x8, 0xffffffffffffffff, 0x0, 0xad31, 0x7, 0x800, 'veth1_to_bridge\x00', 'bond0\x00', {}, {0x2ac0903882b0adb2}}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@dev={[], 0x18}, @loopback, @loopback, 0xf, 0x1}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4c8)

03:35:48 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:35:48 executing program 4:
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x40000, 0x48)
ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000440)={0x2, 0xbf3, 0x6, 0x3ff})
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$mice(&(0x7f0000000280)='/dev/input/mice\x00', 0x0, 0x80)
ioctl$TIOCCBRK(r1, 0x5428)
r2 = socket(0x10, 0x803, 0x0)
r3 = memfd_create(&(0x7f0000000500)='\x00?\x00\x00\x00\x00\x00\x00\x00', 0x7)
ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f0000000140)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x4000, 0x1})
fcntl$getownex(r2, 0x10, &(0x7f0000000180)={0x0, <r4=>0x0})
sched_getparam(r4, &(0x7f00000001c0))
setsockopt$inet_group_source_req(r1, 0x0, 0x2e, &(0x7f00000002c0)={0x2, {{0x2, 0x4e20, @multicast1}}, {{0x2, 0x4e24, @broadcast}}}, 0x36a)
sendto(r2, &(0x7f0000000200)="120000001600e70d017b000000977dc630a8d3fa06113fc6000000005994727322285ce45220d5b25b48fa7ca603c47de657ac08e98d84809e5192d3ec3e000000fece6a895e1726712d65256ef04f2e95fbf509000000224cdad14a33d48bef47", 0x61, 0xfffffffffffffffc, 0x0, 0x0)

[  380.072116] binder: undelivered TRANSACTION_ERROR: 29189
[  380.092564] device lo left promiscuous mode
[  380.098293] device lo entered promiscuous mode
03:35:48 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  380.106579] device lo left promiscuous mode
[  380.141511] binder_alloc: 6582: binder_alloc_buf, no vma
[  380.141530] binder: 6582:6583 transaction failed 29189/-3, size 0-0 line 3136
03:35:48 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:35:48 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  380.141923] binder: undelivered TRANSACTION_ERROR: 29189
[  380.206341] binder_alloc: 6595: binder_alloc_buf, no vma
[  380.206360] binder: 6595:6597 transaction failed 29189/-3, size 0-0 line 3136
[  380.206530] binder: undelivered TRANSACTION_ERROR: 29189
[  380.256686] binder_alloc: 6603: binder_alloc_buf, no vma
[  380.256704] binder: 6603:6604 transaction failed 29189/-3, size 0-0 line 3136
[  380.256870] binder: undelivered TRANSACTION_ERROR: 29189
[  380.306731] binder_alloc: 6607: binder_alloc_buf, no vma
[  380.306749] binder: 6607:6610 transaction failed 29189/-3, size 0-0 line 3136
[  380.307312] binder: undelivered TRANSACTION_ERROR: 29189
[  380.367593] binder_alloc: 6612: binder_alloc_buf, no vma
[  380.367613] binder: 6612:6613 transaction failed 29189/-3, size 0-0 line 3136
[  380.367794] binder: undelivered TRANSACTION_ERROR: 29189
03:35:48 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:35:48 executing program 6:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)})
accept$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000100)=0x1c)
close(r1)
dup(r2)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000140)=[@clear_death={0x400c630f, 0x2, 0x1}, @request_death={0x400c630e, 0x0, 0x1}, @request_death={0x400c630e, 0x2, 0x3}, @acquire, @exit_looper, @decrefs={0x40046307, 0x1}], 0x1f, 0x0, &(0x7f00000001c0)="bae28b54c2db0911c862d4f3ebf430b995244ffdeeaceb9384919e70945532"})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'], 0x0, 0x0, &(0x7f00000001c0)})

[  380.443282] 9pnet_virtio: no channels available for device (null)
03:35:48 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  380.496571] binder: release 6617:6619 transaction 58 out, still active
[  380.505293] binder: undelivered TRANSACTION_COMPLETE
[  380.524301] binder: send failed reply for transaction 58, target dead
[  380.544495] device lo entered promiscuous mode
[  380.551376] binder: 6618:6625 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2
[  380.558226] device lo left promiscuous mode
[  380.567350] device lo entered promiscuous mode
[  380.572584] binder: 6618:6625 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2
[  380.575522] binder: release 6622:6624 transaction 62 out, still active
[  380.575526] binder: undelivered TRANSACTION_COMPLETE
[  380.579704] device lo left promiscuous mode
[  380.585556] binder: send failed reply for transaction 62, target dead
[  380.602556] binder: 6618:6620 unknown command 0
[  380.607296] binder: 6618:6620 ioctl c0306201 20000040 returned -22
[  380.640901] binder: 6618:6625 DecRefs 0 refcount change on invalid ref 1 ret -22
03:35:48 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r5)
ioctl$SG_SET_KEEP_ORPHAN(r4, 0x2287, &(0x7f0000000200))
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

[  380.743834] device lo entered promiscuous mode
[  380.750955] device lo left promiscuous mode
03:35:48 executing program 4:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200)='/dev/net/tun\x00', 0x0, 0x0)
getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000340)={<r1=>0x0}, &(0x7f0000000380)=0xc)
waitid(0x3, r1, &(0x7f00000003c0), 0x60000000, &(0x7f0000000400))
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f00000002c0)=<r2=>0x0)
ptrace$peek(0x3, r2, &(0x7f0000000300))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'eql\x00', 0x2029})
ioctl$TUNSETLINK(r0, 0x400454cd, 0x20000000308)
r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180)='/dev/hwrng\x00', 0x0, 0x0)
getsockopt$inet6_int(r3, 0x29, 0x3f, &(0x7f0000000240), &(0x7f0000000280)=0x4)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2800000010c7e22de4b07fcd170005624f00000000000000", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000"], 0x28}}, 0x0)

03:35:48 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:35:48 executing program 5:
r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x40000, 0x0)
getpeername(r0, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000140)=0x80)
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

[  380.897872] binder: release 6642:6646 transaction 64 out, still active
[  380.907268] binder: undelivered TRANSACTION_COMPLETE
[  380.916414] binder: send failed reply for transaction 64, target dead
[  380.923061] device lo entered promiscuous mode
[  380.943110] device lo left promiscuous mode
[  380.949049] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=50960 sclass=netlink_route_socket pig=6643 comm=syz-executor4
[  381.040559] device lo entered promiscuous mode
[  381.046586] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=50960 sclass=netlink_route_socket pig=6650 comm=syz-executor4
[  381.291778] binder: 6618:6620 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2
[  381.298767] binder: 6618:6620 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2
[  381.299257] binder: 6618:6655 unknown command 0
[  381.299267] binder: 6618:6655 ioctl c0306201 20000040 returned -22
[  381.317540] binder: 6618:6620 DecRefs 0 refcount change on invalid ref 1 ret -22
[  381.890341] IPVS: Creating netns size=2536 id=86
[  382.060977] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  382.075084] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  382.131707] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  382.144871] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  382.200503] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  382.214174] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  382.228149] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  382.242913] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  382.886373] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  382.921181] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  382.927423] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  382.934038] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:35:51 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
close(0xffffffffffffffff)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:35:51 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
socketpair$inet(0x2, 0x806, 0x5, &(0x7f0000000000))

03:35:51 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x0)

03:35:51 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:35:51 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x100)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'lo\x00@\x00', 0x100000000004100})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:35:51 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
creat(&(0x7f0000000200)='./file0\x00', 0x2)

03:35:51 executing program 4:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$inet_int(r0, 0x0, 0x3f, &(0x7f0000000000), &(0x7f0000000040)=0x4)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:35:51 executing program 6:
perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x3, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
open(&(0x7f0000000000)='./file0\x00', 0x800, 0x0)
r0 = open(&(0x7f00009e1000)='./file0\x00', 0xc007d1bed8eee74, 0xfffffffffffffffc)
iopl(0xe460)
fcntl$setlease(r0, 0x400, 0x0)

03:35:51 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  383.979267] device lo entered promiscuous mode
[  383.992552] device lo left promiscuous mode
[  383.996322] binder: 7032:7042 transaction failed 29189/-22, size 0-0 line 3013
[  383.996477] binder: undelivered TRANSACTION_ERROR: 29189
03:35:51 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:35:51 executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
close(0xffffffffffffffff)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

[  384.030466] binder: 7048:7049 transaction failed 29189/-22, size 0-0 line 3013
[  384.040045] binder: undelivered TRANSACTION_ERROR: 29189
03:35:51 executing program 7:
syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  384.088848] binder: 7059:7061 transaction failed 29189/-22, size 0-0 line 3013
[  384.098261] binder: undelivered TRANSACTION_ERROR: 29189
03:35:52 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:35:52 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:35:52 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:35:52 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
r1 = syz_open_dev$sndseq(&(0x7f0000000200)='/dev/snd/seq\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue0\x00'})
ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000240))
fcntl$dupfd(r0, 0x406, r0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

[  384.201422] device lo entered promiscuous mode
[  384.213153] device lo left promiscuous mode
[  384.222049] device lo left promiscuous mode
[  384.228806] device lo left promiscuous mode
03:35:52 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={"6c6f00000000000000000000000200", 0x1800})
ioctl$LOOP_SET_FD(r0, 0x4c00, r0)

03:35:52 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
close(0xffffffffffffffff)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

[  384.312666] device lo entered promiscuous mode
[  384.317388] device lo left promiscuous mode
[  384.321827] device lo entered promiscuous mode
[  384.332064] device lo left promiscuous mode
[  384.340230] device lo entered promiscuous mode
[  384.346534] device lo left promiscuous mode
[  384.389638] device lo entered promiscuous mode
[  384.397629] device lo left promiscuous mode
[  384.509796] device lo entered promiscuous mode
03:35:52 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000000)={'broute\x00'}, &(0x7f0000000100)=0xf4)
fcntl$getownex(r0, 0x10, &(0x7f00000002c0)={0x0, <r1=>0x0})
fcntl$setownex(r0, 0xf, &(0x7f0000000300)={0x0, r1})
r2 = dup(r0)
ioctl$SG_GET_PACK_ID(r2, 0x227c, &(0x7f0000000140))
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'nr0\x00', 0x101})
sendto$inet(r0, &(0x7f00000001c0)="819ff2d67ce4a70b6b5e13a8923583c6405a5f921e046c86eaf89d18182f768397f9e6f4680401674d87b5d1a8d9d8589412c5b62c33d5e995dc51bb58505a86c848a4e63cdb08e1acbc682f2c8eaf1fde79b15f0450604dcd9fcb3a6364cae9c46b46376d3b9664c2937c39c1af2fd2e1c3610a146cdb4238e975039915b6a12286ab3cb1d9771487772cbb5dff9561b9155a4ac55674382475cf2f52f3004151bb62872568b488401578c232cbf3ee32f1a1a645c688f00a13efbb3cf09f19df05a75dca001237c118f16bc8820c9bc6bcf8cc60bfe76642dc371d4df7e27fbf033eadb6441a1a3df6039c9755049ce2", 0xf1, 0x0, &(0x7f0000000080)={0x2, 0x1, @remote}, 0x10)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:35:52 executing program 7:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
socketpair$inet(0x2, 0x806, 0x5, &(0x7f0000000000))

03:35:52 executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
close(0xffffffffffffffff)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:35:52 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x0)

03:35:52 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000000))
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:35:52 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x8480, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r2 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
accept4$packet(r3, &(0x7f0000000200)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000280)=0x14, 0x800)
ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f00000002c0)={@dev={0xfe, 0x80, [], 0x16}, @mcast2, @loopback, 0x9, 0x401, 0xd2e, 0x400, 0x80000001, 0x4c20000, r4})
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x20000, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r5)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0)

[  384.808847] device lo entered promiscuous mode
[  384.818700] device lo left promiscuous mode
03:35:52 executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
close(0xffffffffffffffff)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:35:52 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

[  384.958474] device lo left promiscuous mode
03:35:52 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
keyctl$session_to_parent(0x12)
r2 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x8000)
ioctl$UFFDIO_UNREGISTER(r2, 0x8010aa01, &(0x7f0000000080)={&(0x7f0000003000/0x1000)=nil, 0x1000})
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x40800, 0x0)
write$9p(r3, &(0x7f0000000140)="09655564a78b27230a9d54e4cf551ac7c094ac51b8052e44b617dbcfc6b97dfc48bc59fa7a1210c209f9ad56707acb8c9f9a7f80718f81ff46476bf0031b6050f90e7d30c3888f3346ad70caec4f587e9de48d389ae74b04abb401e7a1ef5fb9aaee666473f9cefd5092010f09f41fc12da9a316f9d266d99bc6deebd48728e583942bb05dfaaf5c5e6d37d42c2895ef96bbfb0f6bfe22532015a42414778017c2c99d1914f93482af13f19fb3aec45bf00b8fbd1f20deea2d8d0bbe3878ee6028362856d4931a656a25ad145a57e90aa02faeea6b7114", 0xd7)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  384.985240] device lo entered promiscuous mode
[  384.996703] device lo left promiscuous mode
[  385.009853] binder: 7130:7132 got transaction to context manager from process owning it
[  385.023266] binder: 7130:7132 transaction failed 29201/-22, size 0-0 line 3004
03:35:52 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={<r0=>0xffffffffffffffff})
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000240)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0}}, {{@in6=@dev}, 0x0, @in6=@mcast1}}, &(0x7f0000000080)=0xe8)
connect(r0, &(0x7f0000000140)=@can={0x1d, r1}, 0x80)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000000)={"6c6f00000000000000000000000200", 0x8000})

03:35:52 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000000)=[0x3, 0x9])

[  385.045361] binder_alloc: binder_alloc_mmap_handler: 7130 20001000-20004000 already mapped failed -16
[  385.055045] binder: BINDER_SET_CONTEXT_MGR already set
[  385.064190] binder: 7130:7133 ioctl 40046207 0 returned -16
[  385.070761] binder_alloc: 7130: binder_alloc_buf, no vma
[  385.076529] binder: 7130:7133 transaction failed 29189/-3, size 0-0 line 3136
03:35:53 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x800)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  385.100164] binder: undelivered TRANSACTION_ERROR: 29201
[  385.108655] device lo entered promiscuous mode
[  385.117449] device lo entered promiscuous mode
[  385.123797] device lo left promiscuous mode
[  385.135871] binder: undelivered TRANSACTION_ERROR: 29189
[  385.188742] binder_alloc: 7142: binder_alloc_buf failed to map page at 20001000 in userspace
[  385.204871] binder: 7142:7143 transaction failed 29201/-12, size 0-0 line 3136
[  385.225293] binder_alloc: binder_alloc_mmap_handler: 7142 20001000-20004000 already mapped failed -16
03:35:53 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000000)={[{0x2f, 'rdma'}, {0x2f, 'memory'}, {0x2b, 'memory'}, {0x2d, 'rdma'}, {0x2b, 'rdma'}, {0x2d, 'memory'}, {0x2f, 'rdma'}, {0x2f, 'memory'}]}, 0x38)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:35:53 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x1000001, 0x0)
ioctl$TIOCSCTTY(r1, 0x540e, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
syz_mount_image$iso9660(&(0x7f0000000000)='iso9660\x00', &(0x7f0000000100)='./file0\x00', 0x9, 0x2, &(0x7f0000000140)=[{&(0x7f00000001c0)="7e9b55338d6d7bfa85fe6ce233c75634d090813192db9158cc1eef828b43bb1653ff344ac440a041f4549443e8fca1c287f4a9767f1f08dc623b3a981e7441b50513f2d2ec97ecbe65898328a44ab125c82f5f2b855c9673d4cacf9e1b007b9f0f94756c", 0x64}, {&(0x7f0000000240)="1bd28963b309b725eac2570525dc5b43cd27fe9669b83bc8d0f32fe02bb5c8e548a0b5ba513f5bba79627ead1f0e5952dc3ed526585bd5c822227c3cbe2adc5edbfecbd46c5aa09dd1b9853aa02a84b8aeb89f2418864e21d572d6d0b8e119d9b4b7", 0x62, 0x400}], 0x400, &(0x7f00000002c0)={[{@norock='norock'}, {@mode={'mode', 0x3d, 0xc3}}]})
ioctl$TIOCSSOFTCAR(r1, 0x541a, &(0x7f0000000040)=0x7)

03:35:53 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
r2 = socket$netlink(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000100)={0x2000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, &(0x7f0000000080), 0xff32)
getsockopt$netlink(r2, 0x10e, 0x9, &(0x7f0000000000)=""/4, &(0x7f0000000280)=0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  385.243869] binder: BINDER_SET_CONTEXT_MGR already set
[  385.249235] device lo left promiscuous mode
[  385.253984] binder: 7142:7144 ioctl 40046207 0 returned -16
[  385.265262] binder: undelivered TRANSACTION_ERROR: 29201
[  385.287345] device lo entered promiscuous mode
[  385.298148] device lo left promiscuous mode
[  385.327347] binder_alloc: 7150: binder_alloc_buf failed to map page at 20001000 in userspace
[  385.347255] binder: 7150:7154 transaction failed 29201/-12, size 0-0 line 3136
[  385.375333] binder_alloc: binder_alloc_mmap_handler: 7150 20001000-20004000 already mapped failed -16
[  385.379381] device lo entered promiscuous mode
[  385.389862] device lo left promiscuous mode
[  385.398119] isofs_fill_super: bread failed, dev=loop1, iso_blknum=16, block=32
[  385.413587] binder: BINDER_SET_CONTEXT_MGR already set
[  385.419645] binder: 7150:7156 ioctl 40046207 0 returned -16
[  385.426291] binder: undelivered TRANSACTION_ERROR: 29201
[  385.438559] device lo entered promiscuous mode
[  385.445012] device lo left promiscuous mode
[  385.473775] IPVS: Creating netns size=2536 id=87
[  385.698704] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  385.712470] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  385.809340] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  385.828925] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  385.888536] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  385.902062] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  385.916185] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  385.931271] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  386.600820] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  386.634637] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  386.640789] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  386.648142] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:35:55 executing program 5:
r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x1, 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000140)={<r2=>0x0}, &(0x7f00000001c0)=0xc)
perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x10000, 0x1000, 0x2, 0x400, 0x0, 0x70c, 0x2000, 0x0, 0x2, 0xfffffffffffffffa, 0x2, 0xffffffff80000001, 0x2, 0x8, 0x2, 0x7, 0x5a01, 0x23ef, 0x8, 0x3, 0x8, 0x8, 0x5, 0x200, 0x800, 0x9c0, 0xfff, 0x40, 0x7, 0x5ad, 0xe71, 0x80, 0x8, 0x910a, 0x6, 0x200, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x8}, 0x40, 0x7, 0x1, 0x3, 0x9, 0x80, 0x9}, r2, 0x2, r0, 0x9)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:35:55 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="0310000000000000f7ff130000000086ad0149ba040d2c39cdddbacd03dcdc84bdf2655632fd752df409aab3802d5ec5272d4448dd5e7760b9193fafe8b5164795a715be66b03f55f52337261f95cb5f6fe472eb280a712ade5bacbb70ed5d969b8ea7da5db09b99091e921b07a811e2b434b44ec5167bb3650c3ab06d84f84c36096c70b37f81cd514b240b86b2a647535ff5c8f8bc5b1fe11447655ebec76612fbf94208cd813b81a5ed94767daef17e11b647"], 0x1}}, 0x0)
r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180)='/dev/hwrng\x00', 0x101080, 0x0)
setsockopt$inet_int(r4, 0x0, 0x3f, &(0x7f0000000200)=0x9, 0x4)
socket$packet(0x11, 0x3, 0x300)
r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r5)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:35:55 executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
close(0xffffffffffffffff)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:35:55 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
close(r0)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(0xffffffffffffffff, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(0xffffffffffffffff, &(0x7f0000001000), 0x1000)

03:35:55 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x802)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000000)={{{@in6=@loopback, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{}, 0x0, @in6=@ipv4={[], [], @multicast1}}}, &(0x7f0000000140)=0xe8)
ioprio_get$uid(0x3, r2)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:35:55 executing program 1:
r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x2, 0x0)
setsockopt$sock_void(r0, 0x1, 0x24, 0x0, 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f0000000000)={'bridge_slave_0\x00', 0x4})

03:35:55 executing program 4:
socket$packet(0x11, 0x3, 0x300)
r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x101040, 0x0)
ioctl$ASHMEM_GET_PIN_STATUS(r0, 0x7709, 0x0)
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0)
r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0)
openat$cgroup_procs(r1, &(0x7f0000000300)="6367726f75702e70726f6373000b816949100445531497cdb3bcf18cfa7befd92197483ab23b662fbd9615b57228cfe5fc881ed993baac961bd7d3b4c1d38bf073c41a23e5ac82eb7425e3635009c0ce521d9875e63f3f8b4ff5de3e23861fec6308649ac95e2eb7e5ade9e2fc9af80569", 0x2, 0x0)
epoll_create(0x2)
pselect6(0x40, &(0x7f0000000140), &(0x7f0000000180), &(0x7f0000000380)={0x7f}, &(0x7f0000000400), &(0x7f0000000480)={&(0x7f0000000440), 0x8})

03:35:55 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x0)

[  387.715584] device lo entered promiscuous mode
[  387.727959] binder_alloc: 7539: binder_alloc_buf failed to map page at 20001000 in userspace
03:35:55 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
r2 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x9, 0x8000)
read$eventfd(r2, &(0x7f0000000040), 0x8)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  387.728007] binder: 7539:7548 transaction failed 29201/-12, size 0-0 line 3136
[  387.742914] binder_alloc: binder_alloc_mmap_handler: 7539 20001000-20004000 already mapped failed -16
03:35:55 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = getpid()
r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
accept4$packet(r3, 0x0, &(0x7f00000002c0), 0x800)
sched_setaffinity(r2, 0x8, &(0x7f0000000180)=0x4)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
pipe(&(0x7f0000000140)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r5 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffffa)
ioctl$PPPIOCGFLAGS(r4, 0x8004745a, &(0x7f00000001c0))
add_key(&(0x7f0000000000)='rxrpc_s\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, r5)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="80634040000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000dd5f013c7d", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

[  387.744082] binder: BINDER_SET_CONTEXT_MGR already set
03:35:55 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r2, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0)
sendfile(r2, r2, &(0x7f0000317000), 0xff8)
quotactl(0x0, &(0x7f0000000040)='./file0/file0\x00', 0x0, &(0x7f0000000100))
lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, <r3=>0x0})
mount$9p_tcp(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x8000, &(0x7f00000001c0)={'trans=tcp,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@nodevmap='nodevmap'}, {@privport='privport'}, {@privport='privport'}, {@access_uid={'access', 0x3d, r3}}, {@aname={'aname', 0x3d, '/dev/binder#\x00'}}, {@access_user='access=user'}, {@version_L='version=9p2000.L'}]}})
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  387.744090] binder: 7539:7548 ioctl 40046207 0 returned -16
[  387.744700] binder_alloc: 7539: binder_alloc_buf, no vma
[  387.744717] binder: 7539:7549 transaction failed 29189/-3, size 0-0 line 3136
[  387.745266] binder: undelivered TRANSACTION_ERROR: 29189
[  387.745340] binder: undelivered TRANSACTION_ERROR: 29201
[  387.802373] binder_alloc: 7555: binder_alloc_buf failed to map page at 20001000 in userspace
03:35:55 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
stat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
r3 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000200)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffffa)
keyctl$get_persistent(0x16, r2, r3)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000000)={<r4=>0xffffffffffffffff})
getsockopt$IP_VS_SO_GET_TIMEOUT(r4, 0x0, 0x486, &(0x7f0000000040), &(0x7f0000000080)=0xc)

[  387.802405] binder: 7555:7556 transaction failed 29201/-12, size 0-0 line 3136
[  387.807706] binder_alloc: binder_alloc_mmap_handler: 7555 20001000-20004000 already mapped failed -16
[  387.807956] binder: BINDER_SET_CONTEXT_MGR already set
03:35:55 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  387.807964] binder: 7555:7557 ioctl 40046207 0 returned -16
[  387.808057] binder_alloc: 7555: binder_alloc_buf, no vma
[  387.808074] binder: 7555:7556 transaction failed 29189/-3, size 0-0 line 3136
03:35:55 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
pwrite64(r1, &(0x7f0000000080)="3c9aea2c9ad4608436f510e29b2fa4003a88a00a245400b250db3c9259723535c160401f4a950939c1914288fa55a52fad2ea59a34cfa8626168839669961f221043", 0x42, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x1, 0x0)
ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000040))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  387.808385] binder: undelivered TRANSACTION_ERROR: 29189
[  387.808462] binder: undelivered TRANSACTION_ERROR: 29201
[  387.854160] binder: 7562:7563 unknown command 1077961600
03:35:55 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x400000000000)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  387.854171] binder: 7562:7563 ioctl c0306201 20000440 returned -22
[  387.863809] binder: BINDER_SET_CONTEXT_MGR already set
[  387.863817] binder: 7562:7563 ioctl 40046207 0 returned -16
[  387.927272] binder: 7566:7567 ioctl c0306201 20000440 returned -14
03:35:56 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x1000)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0)
madvise(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x8008)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063384000000000000000000000000000000000000000004db3f7dd40800000000000000000000000000000000000060000d4f335915f1a21743f9ae8209efc8fa8d1e3c52106c523493c", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})
socket$inet6(0xa, 0x6, 0x0)

[  387.933477] binder_alloc: binder_alloc_mmap_handler: 7566 20001000-20004000 already mapped failed -16
[  387.934509] binder: BINDER_SET_CONTEXT_MGR already set
[  387.934516] binder: 7566:7567 ioctl 40046207 0 returned -16
[  387.934890] binder: 7566:7567 ioctl c0306201 20000440 returned -14
[  387.985770] binder_alloc: 7570: binder_alloc_buf failed to map page at 20001000 in userspace
[  387.985804] binder: 7570:7571 transaction failed 29201/-12, size 0-0 line 3136
[  387.990855] binder_alloc: binder_alloc_mmap_handler: 7570 20001000-20004000 already mapped failed -16
[  387.997931] binder: BINDER_SET_CONTEXT_MGR already set
[  387.997942] binder: 7570:7571 ioctl 40046207 0 returned -16
[  387.998910] binder_alloc: 7570: binder_alloc_buf, no vma
[  387.998927] binder: 7570:7572 transaction failed 29189/-3, size 0-0 line 3136
[  388.000364] binder: undelivered TRANSACTION_ERROR: 29189
[  388.000422] binder: undelivered TRANSACTION_ERROR: 29201
[  388.026179] binder_alloc: 7573: binder_alloc_buf failed to map page at 20001000 in userspace
[  388.034633] binder: 7573:7575 transaction failed 29201/-12, size 0-0 line 3136
[  388.050349] binder_alloc: binder_alloc_mmap_handler: 7573 20001000-20004000 already mapped failed -16
[  388.051434] binder: BINDER_SET_CONTEXT_MGR already set
[  388.051442] binder: 7573:7576 ioctl 40046207 0 returned -16
[  388.051856] binder: undelivered TRANSACTION_ERROR: 29201
[  388.090967] binder_alloc: 7578: binder_alloc_buf failed to map page at 20001000 in userspace
[  388.102813] binder: 7578:7579 transaction failed 29201/-12, size 0-0 line 3136
[  388.115419] binder: BINDER_SET_CONTEXT_MGR already set
[  388.115427] binder: 7578:7579 ioctl 40046207 0 returned -16
[  388.122065] binder_alloc: 7578: binder_alloc_buf, no vma
[  388.122081] binder: 7578:7580 transaction failed 29189/-3, size 0-0 line 3136
[  388.122436] binder: undelivered TRANSACTION_ERROR: 29189
[  388.122510] binder: undelivered TRANSACTION_ERROR: 29201
[  388.145749] binder_alloc: 7581: binder_alloc_buf failed to map page at 20001000 in userspace
[  388.145794] binder: 7581:7583 transaction failed 29201/-12, size 0-0 line 3136
[  388.150066] binder_alloc: binder_alloc_mmap_handler: 7581 20001000-20004000 already mapped failed -16
[  388.150163] binder: BINDER_SET_CONTEXT_MGR already set
[  388.150171] binder: 7581:7584 ioctl 40046207 0 returned -16
[  388.150541] binder: undelivered TRANSACTION_ERROR: 29201
[  388.189785] binder: 7586:7587 unknown command 1077437184
[  388.189808] binder: 7586:7587 ioctl c0306201 20000440 returned -22
[  388.230122] binder_alloc: binder_alloc_mmap_handler: 7586 20001000-20004000 already mapped failed -16
[  388.231190] binder: BINDER_SET_CONTEXT_MGR already set
[  388.231198] binder: 7586:7587 ioctl 40046207 0 returned -16
[  388.232228] binder: 7586:7590 unknown command 1077437184
[  388.232236] binder: 7586:7590 ioctl c0306201 20000440 returned -22
[  388.476910] device lo entered promiscuous mode
[  388.485057] device lo left promiscuous mode
[  388.492165] device lo left promiscuous mode
[  388.585496] device lo entered promiscuous mode
[  388.591728] device lo left promiscuous mode
[  388.597392] device lo entered promiscuous mode
[  388.604823] device lo left promiscuous mode
03:35:56 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000240)=[@increfs={0x40046304, 0x4}, @exit_looper], 0x82, 0x0, &(0x7f0000000380)="5fab4966ad94b3fd9e221f6de5d578a389d360124096b311fedab984f75a32759a00f75943c6c72ddf575c0da7ab29c981488beb8a33e7f9676ac9ac649dfbe27af73c982ec99633af0eb9b9d1acb7d3e3857157629b8af9874590fc0b3b0329b555c8d51de04cd89e9c243fbcfd32fc71dc602d8f0c4e8ec847e4102fad0eca856b"})
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
ioctl$LOOP_GET_STATUS64(r2, 0x4c05, &(0x7f0000000140))
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
rt_sigprocmask(0x1, &(0x7f0000000040)={0x4}, &(0x7f0000000080), 0x8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
ioctl$RTC_AIE_ON(r3, 0x7001)

[  388.672922] IPVS: Creating netns size=2536 id=88
[  388.678976] binder: 7599:7602 IncRefs 0 refcount change on invalid ref 4 ret -22
[  388.697881] binder_alloc: 7599: binder_alloc_buf failed to map page at 20001000 in userspace
[  388.707217] binder: 7599:7602 transaction failed 29201/-12, size 0-0 line 3136
03:35:56 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="03000000000000000800000000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

[  388.716280] binder: 7599:7602 IncRefs 0 refcount change on invalid ref 4 ret -22
[  388.725487] binder: BINDER_SET_CONTEXT_MGR already set
[  388.730916] binder: 7599:7606 ioctl 40046207 0 returned -16
[  388.736977] binder_alloc: 7599: binder_alloc_buf, no vma
[  388.736993] binder: 7599:7602 transaction failed 29189/-3, size 0-0 line 3136
[  388.737190] binder: undelivered TRANSACTION_ERROR: 29189
[  388.737247] binder: undelivered TRANSACTION_ERROR: 29201
[  388.980939] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  389.034676] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  389.513351] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  389.528173] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  389.584844] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  389.599686] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  389.613156] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  389.628078] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  390.392142] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  390.427465] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  390.433583] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  390.441130] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:35:59 executing program 5:
r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380)
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
getpeername$packet(r1, &(0x7f0000000400)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000440)=0x14)
setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000480)={r2, 0x1, 0x6, @random="dce89590f697"}, 0x10)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000640)={r2, 0x1, 0x6, @dev={[], 0x12}}, 0x10)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000001c0)={'veth0_to_bond\x00', 0x400})
getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000540)={{{@in=@local, @in=@broadcast}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in6=@local}}, &(0x7f0000000380)=0xe8)
ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f00000003c0))
ioctl$UI_GET_SYSNAME(r0, 0x8040552c, &(0x7f0000000680))
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$KDGETKEYCODE(r0, 0x4b4c, &(0x7f0000000780)={0x4, 0x809})
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x200202, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in=@multicast2}, 0x0, @in6=@ipv4={[], [], @broadcast}}}, &(0x7f0000000040)=0xe8)
setsockopt$packet_drop_memb(r4, 0x107, 0x2, &(0x7f0000000140)={r5, 0x1, 0xfffffe42}, 0xfffffffffffffd2d)

03:35:59 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r2, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0)
sendfile(r2, r2, &(0x7f0000317000), 0xff8)
quotactl(0x0, &(0x7f0000000040)='./file0/file0\x00', 0x0, &(0x7f0000000100))
lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, <r3=>0x0})
mount$9p_tcp(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x8000, &(0x7f00000001c0)={'trans=tcp,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@nodevmap='nodevmap'}, {@privport='privport'}, {@privport='privport'}, {@access_uid={'access', 0x3d, r3}}, {@aname={'aname', 0x3d, '/dev/binder#\x00'}}, {@access_user='access=user'}, {@version_L='version=9p2000.L'}]}})
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:35:59 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd38"], 0x48)

03:35:59 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
close(r0)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(0xffffffffffffffff, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(0xffffffffffffffff, &(0x7f0000001000), 0x1000)

[  391.487905] device lo entered promiscuous mode
[  391.496720] device lo left promiscuous mode
[  391.593880] device lo entered promiscuous mode
[  391.600403] device lo left promiscuous mode
[  392.200964] IPVS: Creating netns size=2536 id=89
[  392.227555] IPVS: Creating netns size=2536 id=90
[  392.532641] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  392.550366] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  392.558855] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  392.577208] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  392.639749] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  392.659520] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  392.668062] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  392.687180] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  392.749109] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  392.773497] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  392.795381] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  392.802784] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  392.811923] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  392.823921] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  392.831824] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  392.839413] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  392.847283] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  392.856207] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  392.873984] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  392.881015] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  392.889320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  392.900882] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  392.907936] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  392.915709] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  393.970921] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  394.025280] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  394.031411] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  394.038835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  394.046708] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  394.100881] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  394.107542] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  394.117429] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:36:02 executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
close(0xffffffffffffffff)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:02 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x3bafd980196e5e4a, 0x0)
getpeername$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev}, &(0x7f0000000080)=0x1c)
setsockopt$inet_tcp_TLS_RX(r1, 0x6, 0x2, &(0x7f0000000100), 0x4)

03:36:02 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

03:36:02 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$usbmon(&(0x7f0000000200)='/dev/usbmon#\x00', 0x4, 0x40002)
ioctl$TIOCCONS(r1, 0x541d)
r2 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r4 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r5)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r2)

03:36:02 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={"6c6f00000000000000000000000200", 0x80000})

03:36:02 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r2, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0)
sendfile(r2, r2, &(0x7f0000317000), 0xff8)
quotactl(0x0, &(0x7f0000000040)='./file0/file0\x00', 0x0, &(0x7f0000000100))
lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, <r3=>0x0})
mount$9p_tcp(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x8000, &(0x7f00000001c0)={'trans=tcp,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@nodevmap='nodevmap'}, {@privport='privport'}, {@privport='privport'}, {@access_uid={'access', 0x3d, r3}}, {@aname={'aname', 0x3d, '/dev/binder#\x00'}}, {@access_user='access=user'}, {@version_L='version=9p2000.L'}]}})
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:02 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd38"], 0x48)

[  394.525107] device lo entered promiscuous mode
03:36:02 executing program 0:
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

[  394.550540] binder_alloc: 8747: binder_alloc_buf failed to map page at 20001000 in userspace
[  394.551300] device lo entered promiscuous mode
[  394.559254] device lo left promiscuous mode
[  394.565903] device lo left promiscuous mode
[  394.631923] binder: 8747:8751 transaction failed 29201/-12, size 0-0 line 3136
03:36:02 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000000)='smaps_rollup\x00')
getpeername$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000080)=0x14)
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000140)={{{@in=@remote, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@remote}}, &(0x7f00000000c0)=0xe8)
setsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000480)={{{@in=@dev={0xac, 0x14, 0x14, 0xe}, @in=@local, 0x4e20, 0x0, 0x4e23, 0x3, 0x2, 0x80, 0x20, 0x0, r3, r4}, {0xe4ca, 0x401, 0x3, 0x4, 0xfffffffffffffc70, 0x3ff, 0x7, 0x8}, {0x1, 0x7ff, 0x0, 0x8ad0}, 0x10000}, {{@in=@broadcast, 0x4d6, 0x32}, 0xa, @in=@broadcast, 0x0, 0x3, 0x1, 0x36, 0x7ff, 0x3, 0xffffffffffffffff}}, 0xe8)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  394.659195] binder_alloc: binder_alloc_mmap_handler: 8747 20001000-20004000 already mapped failed -16
[  394.671118] binder: BINDER_SET_CONTEXT_MGR already set
[  394.676619] binder: 8747:8765 ioctl 40046207 0 returned -16
[  394.683024] binder: undelivered TRANSACTION_ERROR: 29201
03:36:02 executing program 7:
openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000ffff00000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

[  394.717683] binder_alloc: 8768: binder_alloc_buf failed to map page at 20001000 in userspace
[  394.726365] binder: 8768:8770 transaction failed 29201/-12, size 0-0 line 3136
[  394.735585] binder_alloc: binder_alloc_mmap_handler: 8768 20001000-20004000 already mapped failed -16
[  394.745909] binder: BINDER_SET_CONTEXT_MGR already set
[  394.751203] binder: 8768:8771 ioctl 40046207 0 returned -16
[  394.758543] binder: undelivered TRANSACTION_ERROR: 29201
03:36:02 executing program 1:
r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x40000, 0x20)
ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000180)={0x3, &(0x7f0000000080)=[{}, {}, {}]})
ioctl$KDGKBLED(r0, 0x4b64, &(0x7f0000000040))
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$fiemap(r1, 0xc020660b, &(0x7f00000001c0)={0x5, 0x1400, 0x4, 0x9, 0x2, [{0x200, 0x1ff, 0x4, 0x0, 0x0, 0x2}, {0x234e, 0x80000001, 0x8, 0x0, 0x0, 0x8}]})
lstat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0))
fstat(r1, &(0x7f0000000100))
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={"00000000e8ff000000ab0000007800", 0x1400})

[  394.779100] device lo entered promiscuous mode
[  394.787383] binder_alloc: 8774: binder_alloc_buf size 16776960 failed, no address space
[  394.796073] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  394.804942] binder: 8774:8775 transaction failed 29201/-28, size 16776960-0 line 3136
[  394.805322] device lo left promiscuous mode
[  394.821717] binder: BINDER_SET_CONTEXT_MGR already set
[  394.827052] binder: 8774:8775 ioctl 40046207 0 returned -16
[  394.834684] device lo entered promiscuous mode
[  394.836715] device lo left promiscuous mode
[  394.845291] binder_alloc: 8774: binder_alloc_buf, no vma
[  394.845308] binder: 8774:8776 transaction failed 29189/-3, size 16776960-0 line 3136
[  394.845555] binder: undelivered TRANSACTION_ERROR: 29189
03:36:02 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0xf)
getsockname(0xffffffffffffff9c, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x0, <r2=>0xffffffffffffffff, {0x2, 0x0, @dev}}}, &(0x7f00000000c0)=0x80)
setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f0000000180)={0x3, &(0x7f0000000140)=[{0xfffffffffffff49e, 0x10001, 0x10001, 0xffff}, {0x9142, 0xa1, 0x5000000000, 0x5}, {0x5, 0x2, 0x2, 0x7}]}, 0x10)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  394.845614] binder: undelivered TRANSACTION_ERROR: 29201
[  394.857281] IPVS: Creating netns size=2536 id=91
[  394.914240] binder_alloc: 8785: binder_alloc_buf failed to map page at 20001000 in userspace
03:36:02 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x40006, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
socket$inet(0x2, 0x0, 0x0)
bind$inet(0xffffffffffffffff, &(0x7f0000011ff0)={0x2, 0x0, @multicast2}, 0x10)
getsockopt$IP_VS_SO_GET_SERVICES(0xffffffffffffffff, 0x0, 0x482, &(0x7f00000008c0)=""/193, &(0x7f0000000280)=0xffffffffffffff05)
fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff)
setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000000)="766574683100000000ffffffffffef00", 0x10)
r1 = socket$inet6(0xa, 0x3, 0x1)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f00000001c0)={@remote, 0x800, 0x0, 0xff, 0xffffffffffffffff}, 0x91)
socket(0x0, 0x0, 0x0)
ioctl$EVIOCGBITKEY(0xffffffffffffffff, 0x80404521, &(0x7f00000002c0)=""/112)
ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000240))
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:02 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0)
ioctl$BLKTRACESTART(r1, 0x1274, 0x0)

[  394.925476] binder: 8785:8787 transaction failed 29201/-12, size 0-0 line 3136
03:36:02 executing program 0:
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:02 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
lstat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000280))
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
r5 = pkey_alloc(0x0, 0x2)
pkey_free(r5)

[  394.968648] device lo entered promiscuous mode
[  394.980836] device lo entered promiscuous mode
[  394.990915] binder_alloc: binder_alloc_mmap_handler: 8785 20001000-20004000 already mapped failed -16
[  395.001811] device lo left promiscuous mode
[  395.021119] device lo entered promiscuous mode
[  395.034900] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable
[  395.037384] device lo left promiscuous mode
[  395.043900] device lo left promiscuous mode
[  395.065665] binder: BINDER_SET_CONTEXT_MGR already set
[  395.070945] binder: 8785:8800 ioctl 40046207 0 returned -16
[  395.084262] binder: undelivered TRANSACTION_ERROR: 29201
[  395.196901] device lo entered promiscuous mode
[  395.206750] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable
[  395.221229] device lo left promiscuous mode
03:36:03 executing program 4:
r0 = dup(0xffffffffffffff9c)
setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000000)=@req={0x228, 0x8, 0x20, 0x5}, 0x10)
madvise(&(0x7f000004f000/0x4000)=nil, 0x4000, 0x0)
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00')
sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x38, r2, 0x420, 0x70bd2c, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x100000001}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x4}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x8}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x4)
ioctl(r1, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070")
mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x0, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000836000/0x400000)=nil, 0x400000, 0x3)
write$UHID_DESTROY(r0, &(0x7f00000001c0), 0x4)

03:36:03 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="006340400000001792ff14a6885ef3a37163cb36052d81000000000000000000000000000000000000000000000000000000000000003a000000000000000000000000000cc003c6d369d263fc68087759d904a60529a349bc28a2068cf8b784c5511e48d23c6a8c47314c7f1c25db5662e18795d1b67d8e3ae169d4dfbfcfc04965649f45afac6204da1936a46617ab34a62463453f6206483c351a66628eb4620ef74ca2bb050f6b59dd5827b4050a02fcd32e4d2fd5afc21748554acb09c60820ca558fb376deac1e7a06bf277de79ec9a6337353c78d7e97bef8eafd0e2071b2f5cc52d960b514a64f6c25c77b4bf65b959ff1429e6a4a00b24ae4b5f202db9857ef0d05ebdbe5c3ab751a6ad6165e0d6867daf882ee3d9c072b87a748e20aec31e4238943b069e72949375144850902068fd8c114d738168c9150b3b4eca540599ac0f3510f64689323f9373c8ac2f2ad90ab54", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

03:36:03 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
pipe2(&(0x7f00000000c0)={<r1=>0xffffffffffffffff}, 0x80000)
r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000140)='fou\x00')
sendmsg$FOU_CMD_DEL(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x28180000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x48, r2, 0x232, 0x70bd2b, 0x25dfdbfe, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_TYPE={0x8, 0x4, 0x3}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x3b}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e21}, @FOU_ATTR_TYPE={0x8, 0x4, 0x3}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x4840, 0x0)
openat$cgroup_int(r3, &(0x7f0000000440)="6370752e9bc923624fa8ab943b2fd31e572fb87f20c6eb6c3b4a7d4071a42c49949150ef9b30b1098a23c8f9add1a4496942e5c09262660ca2bcfd643a3b60b8efd56d9705656accc9027a82a9188959aa87c73a815f3ed89a75de6a895e65c9b867f73a6eefc77e2a", 0x2, 0x0)
ioctl$EVIOCGEFFECTS(r3, 0x80044584, &(0x7f00000002c0)=""/205)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'lo\x00@\x00', 0x102})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:03 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x800000000000001, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:03 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd38"], 0x48)

[  395.411943] device lo entered promiscuous mode
[  395.428959] binder: 8845:8853 got transaction to invalid handle
[  395.428968] binder: 8845:8853 transaction failed 29201/-22, size 0-0 line 3013
[  395.433316] binder_alloc: binder_alloc_mmap_handler: 8845 20001000-20004000 already mapped failed -16
[  395.433413] binder: BINDER_SET_CONTEXT_MGR already set
[  395.433420] binder: 8845:8856 ioctl 40046207 0 returned -16
[  395.433735] binder: undelivered TRANSACTION_ERROR: 29201
[  395.476899] device lo entered promiscuous mode
[  395.484907] device lo left promiscuous mode
[  395.561797] device lo left promiscuous mode
[  395.571478] device lo entered promiscuous mode
[  395.577392] device lo left promiscuous mode
[  395.623915] device lo entered promiscuous mode
[  395.628721] device lo left promiscuous mode
[  395.725629] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  395.740117] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  395.800481] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  395.814478] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  395.876718] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  395.890947] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  395.905018] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  395.920816] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  395.927810] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  395.935678] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  396.608760] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  396.642356] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  396.648806] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  396.656280] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:36:04 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[{0x3, 0x1}], 0x1)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f0000000040)={'bridge_slave_0\x00', {0x2, 0x4e23, @broadcast}})

03:36:04 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r2, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0)
sendfile(r2, r2, &(0x7f0000317000), 0xff8)
quotactl(0x0, &(0x7f0000000040)='./file0/file0\x00', 0x0, &(0x7f0000000100))
lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, <r3=>0x0})
mount$9p_tcp(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x8000, &(0x7f00000001c0)={'trans=tcp,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@nodevmap='nodevmap'}, {@privport='privport'}, {@privport='privport'}, {@access_uid={'access', 0x3d, r3}}, {@aname={'aname', 0x3d, '/dev/binder#\x00'}}, {@access_user='access=user'}, {@version_L='version=9p2000.L'}]}})
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:04 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
ioctl$TUNSETLINK(r2, 0x400454cd, 0x334)
openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="03000024e7b1218ad1098e0c900099ab0000009d00376153ec689b16ed00000000235eec26ace93314294927ba6e59cfb8fe87268a1db1d8757779e80a51245204245121112cc6c39ffad4d19c8cff616d998f4ae913bf039c091429b19ad9cd7168ea082757e77d8f3180cae5e97998682c609b8c781bac2276d098776cbb43bb15ccd2df5d81fca3190e185b6c4603c8735629f04ce0167246212cd2d5528cb85e14dcf9923fdc2eb4525629c6ea86c9afdafbe1be583685aa8e00080000c8e0fece0000000000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:36:04 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x400800)
write$P9_RLINK(r1, &(0x7f0000000040)={0x7, 0x47, 0x1}, 0x7)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'lo\x00', 0x2})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:04 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0xff80000000000003)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0)
getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={<r2=>0x0}, &(0x7f0000000080)=0xc)
getpgrp(r2)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x400, 0x0)
ioctl$PIO_FONTX(r3, 0x4b6c, &(0x7f0000000140)="38e760142e8895c4cfa615bb5e842b11d9ec355065313a8417b6c847abc7531fee61a21bd0bc96206dec162586a3d57489e8ffa503afd00d741971629de92034380c37fa5466e46001934db9bfb786d109e31e5d827594cc4dc58cf1adcadf")
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:04 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be"], 0x6c)

03:36:04 executing program 4:
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
pipe(&(0x7f0000000200)={<r0=>0xffffffffffffffff})
setsockopt$inet_buf(r0, 0x0, 0x2e, &(0x7f0000000240)="fca0ed6692b66205de2ba08107c836d599914f406e86ed90b5671b4b7ab1a5f47011a656d543ebbbc04f877396905d22c6ce574abb7045d00feacd6ee180b49c17affcad49d1fff8ef8a97bed127f4df9ed897d3fdfefc58eb2195291b192885b42a5f4364cb54f0c6c043e15070aaf4632909aa5e04a7e6b749e19baf4e7d7f2f74b778dca4f94a45fed1493a58c6e71bc116952782d853ec899e0e14ab2f1f30bf77574437bbe14745955e7894acf2dacbf0340e9d3fa9a749842d08d4053665c9b991b7682732cc8e9be44cda53fc09a80e9263fe74d3cb895e31ff672fb461abb3bea4595ff2", 0xe8)
unshare(0x503)
r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000440)="2f65786500e1ffffff0409004bddd9de91be10eebf000ee9a90f798058439ed554fa07424adee901d2da75af1f02acc7edbcd7a071fbbc7864c3cf7318e89c6e97ca49e2523f8d54c646dd47000000000000000000000082c8ed780fc8de13aac81a5393802cac9b30bd34f4b1aa91950e3321095ed1dc0609f379617d65d54e4900f041cf05b8b29c725e548eba7414e6686d0e4d0e354ffbecf9b6cb56df37daad793393cdf96d60c334d7dee99d58bb98ec8fbae88509abe32fd44239abb4ccf659f55c76c288ae1d12b8aef689f19c39d9cdd8a249969185b3f229a48ef301365dc6762a1967eb3241f49796f3f6ceb28fd1833071281f0d81aee58fc8a61050486d5641c3dfc84c25baa2b3712cb8251267e70159894f6dd8f293e8cd44ea35ca1c52f1c165b6391d779405fabfaf835c2928c61282a10cfee523c694139d9b158c8ac9c2068deae9563a8661cef5dfb87149694d3b000cd5cc727f52139996dd2f575b0af9cc013f275d3651")
pread64(r1, &(0x7f00000005c0)=""/67, 0x43, 0x0)
fsetxattr(r2, &(0x7f0000000000)=@known='user.syz\x00', &(0x7f00000000c0)='\x00', 0xfe9, 0x0)
getpeername(r1, &(0x7f0000000100)=@sco, &(0x7f0000000180)=0x80)
r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000664fc0)={0x0, 0x5, 0x71a})
clock_adjtime(0x3, &(0x7f0000000340)={0x1, 0x800, 0x0, 0x80, 0x3da, 0x100000001, 0x7fff, 0x3, 0x101, 0x1, 0x5b09ba6f, 0x81, 0x1f, 0x10000, 0x54f, 0x1, 0x2, 0x0, 0xffffffff, 0x0, 0x7, 0x1f, 0x8, 0x100000000, 0x8000, 0x8})
write$P9_RFSYNC(r1, &(0x7f00000001c0)={0x7, 0x33, 0x2}, 0x7)
mq_timedsend(r3, &(0x7f0000000040), 0x174, 0x0, &(0x7f0000000040))
mq_timedreceive(r3, &(0x7f00000011c0)=""/4096, 0x93b1643f93b0cb3a, 0x0, &(0x7f0000000080))
vmsplice(r3, &(0x7f00000007c0)=[{&(0x7f00000006c0)="469ff3b7a9f89f27b638af963bf69fdd71a3d4180ebd4dbca34326a8cd9d16acb9a52c7e86b75dfa8a3b042dfca9da8187b40f3847d906a3a69122f0e6b444e1ff312c94d9b7fa44a274ff68f226e1d94d5f9d4f8464c683983da7cd89cd624ef7100adb1670cda1ccb3558ae85285e508a76d64a24fd36eeb57b5423b4e351986591609af33568c2dc85ccb4329f9c95a8264130a7900e6d39071d458754381198624bfe0af17ff4f47a494a1a300da337b54d3a09ce36dc16da35cd0ae86e7d5f97a4e9a01", 0xc6}], 0x1, 0x4)
getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000640), &(0x7f0000000680)=0x14)
ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5)

[  396.892064] binder: 9207:9208 ioctl c0306201 20000440 returned -14
[  396.923320] device lo entered promiscuous mode
[  396.929641] binder: 9214:9219 transaction failed 29189/-22, size 0-0 line 3013
03:36:04 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r2, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0)
sendfile(r2, r2, &(0x7f0000317000), 0xff8)
quotactl(0x0, &(0x7f0000000040)='./file0/file0\x00', 0x0, &(0x7f0000000100))
lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, <r3=>0x0})
mount$9p_tcp(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x8000, &(0x7f00000001c0)={'trans=tcp,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@nodevmap='nodevmap'}, {@privport='privport'}, {@privport='privport'}, {@access_uid={'access', 0x3d, r3}}, {@aname={'aname', 0x3d, '/dev/binder#\x00'}}, {@access_user='access=user'}, {@version_L='version=9p2000.L'}]}})
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  396.939726] binder_alloc: binder_alloc_mmap_handler: 9214 20ffa000-20ffe000 already mapped failed -16
[  396.949489] binder: BINDER_SET_CONTEXT_MGR already set
[  396.955014] binder: 9214:9223 ioctl 40046207 0 returned -16
03:36:04 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r2, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0)
sendfile(r2, r2, &(0x7f0000317000), 0xff8)
quotactl(0x0, &(0x7f0000000040)='./file0/file0\x00', 0x0, &(0x7f0000000100))
lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, <r3=>0x0})
mount$9p_tcp(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x8000, &(0x7f00000001c0)={'trans=tcp,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@nodevmap='nodevmap'}, {@privport='privport'}, {@privport='privport'}, {@access_uid={'access', 0x3d, r3}}, {@aname={'aname', 0x3d, '/dev/binder#\x00'}}, {@access_user='access=user'}, {@version_L='version=9p2000.L'}]}})
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  396.955017] binder: BINDER_SET_CONTEXT_MGR already set
[  396.955028] binder: 9215:9222 ioctl 40046207 0 returned -16
[  396.955873] binder: 9215:9222 ioctl c0306201 20000440 returned -14
[  396.975508] device lo entered promiscuous mode
[  396.979532] device lo left promiscuous mode
[  397.000706] binder: 9226:9229 ioctl c0306201 20000440 returned -14
[  397.004274] binder: 9214:9219 transaction failed 29189/-22, size 0-0 line 3013
[  397.004499] binder: undelivered TRANSACTION_ERROR: 29189
[  397.004567] binder: undelivered TRANSACTION_ERROR: 29189
[  397.047411] binder: 9232:9235 ioctl c0306201 20000440 returned -14
[  397.180887] device lo left promiscuous mode
[  397.196414] device lo entered promiscuous mode
[  397.202112] device lo entered promiscuous mode
[  397.208509] device lo left promiscuous mode
[  397.252751] device lo left promiscuous mode
[  397.272409] IPVS: Creating netns size=2536 id=92
[  397.313561] IPVS: Creating netns size=2536 id=93
[  397.626327] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  397.644519] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  397.677620] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  397.697294] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  397.747437] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  397.774620] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  397.806145] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  397.825375] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  397.874013] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  397.892327] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  397.911208] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  397.929572] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  397.937920] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  397.957701] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  397.977188] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  397.996484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  399.045796] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  399.077830] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  399.099758] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  399.105943] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  399.112596] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  399.143352] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  399.149796] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  399.157495] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:36:08 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0)
ioctl$ASHMEM_SET_PROT_MASK(r1, 0x40087705, &(0x7f0000000080)={0x80000000, 0x401})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x0, 0x0)
ioctl$ASHMEM_PURGE_ALL_CACHES(r2, 0x770a, 0x0)
ioctl$ASHMEM_SET_SIZE(r2, 0x40087703, 0x9)
fcntl$setsig(r0, 0xa, 0x32)
pwrite64(r0, &(0x7f00000001c0)="69b9a8d9b5b32e95a7ecb8cd4696e276e7d5447bfad8152386d62f60e040568a128fa4eb97c67ef25579712fbc77df8f4d5127541b114d04e5d52bc09d2a34260966d2dfaea11ced36a5cdb70f807ad252d59ec76dfad41a402ba9efe64fa4fdbe1282b0547d068b888d75d9667c60194743289a0b63ca5b97770d9e3fa043da1c37759e9484e05dba77af29f2a96cbe323bb21a53f4646de5d34369eeca6918", 0xa0, 0x0)

03:36:08 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
quotactl(0x0, &(0x7f0000000040)='./file0/file0\x00', 0x0, &(0x7f0000000100))
lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
mount$9p_tcp(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x8000, &(0x7f00000001c0)={'trans=tcp,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@nodevmap='nodevmap'}, {@privport='privport'}, {@privport='privport'}, {@access_uid={'access', 0x3d, r2}}, {@aname={'aname', 0x3d, '/dev/binder#\x00'}}, {@access_user='access=user'}, {@version_L='version=9p2000.L'}]}})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:08 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
r2 = mmap$binder(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x2000000, 0x10, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={r2})
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

03:36:08 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
r5 = socket$packet(0x11, 0x3, 0x300)
openat$ipvs(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/ipv4/vs/schedule_icmp\x00', 0x2, 0x0)
r6 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
openat$cgroup_subtree(r4, &(0x7f0000000280)='cgroup.subtree_control\x00', 0x2, 0x0)
r7 = fcntl$getown(r5, 0x9)
ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r7, 0xfff, &(0x7f0000000200)=""/24)
ioctl$LOOP_SET_FD(r0, 0x4c00, r6)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:36:08 executing program 5:
r0 = syz_open_dev$rtc(&(0x7f0000000000)='/dev/rtc#\x00', 0x10000, 0x400)
ioctl$RTC_UIE_OFF(r0, 0x7004)
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0x80000000000000, 0x801)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"00000000e500", 0x800002100})

03:36:08 executing program 0:
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:08 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be"], 0x6c)

03:36:08 executing program 4:
r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0)
getsockopt$EBT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000180)={'broute\x00'}, &(0x7f0000000200)=0x78)
socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000080))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz0\x00', 0x1ff)
fallocate(r1, 0x1, 0x0, 0x10000101)
ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040))
getpgid(0xffffffffffffffff)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000240)={0x2, 'ip6gre0\x00'}, 0x18)
ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, &(0x7f0000000180)={{0x2, 0x4e24, @broadcast}, {0x1, @random="59a310eebccc"}, 0x0, {0x2, 0x4e21, @broadcast}, 'team0\x00'})
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getsockopt$inet_opts(r0, 0x0, 0x9, &(0x7f0000000540)=""/4096, &(0x7f0000000280)=0x1000)
r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82)
r3 = memfd_create(&(0x7f0000000480)="00eb0c432d0174df5f00", 0x3)
pwritev(r3, &(0x7f0000000340)=[{&(0x7f0000000040)}], 0x1, 0x81806)
ioctl$UI_END_FF_UPLOAD(r3, 0x406855c9, &(0x7f0000000380)={0x10, 0x8001, {0x57, 0x0, 0x6, {0x0, 0xfc}, {0x2, 0x2}, @ramp={0x9, 0x2, {0x3, 0x6, 0x5, 0x7}}}, {0x53, 0x0, 0x5, {0x3, 0x6d}, {0x100, 0x1}, @period={0x0, 0x80000001, 0x100, 0xfffffffffffffffc, 0x0, {0x3, 0x7, 0x3, 0xfffffffffffffe01}, 0x1, &(0x7f00000002c0)=[0x8001]}}})
ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3)
sendfile(r2, r2, &(0x7f0000000000), 0x2000005)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f00000000c0)={0x3, 0x1, 0xffffffffffffffff, 0x3, 0x9})
creat(&(0x7f0000000040)='./file0\x00', 0x0)

03:36:08 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
quotactl(0x0, &(0x7f0000000040)='./file0/file0\x00', 0x0, &(0x7f0000000100))
lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:08 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000080)={<r1=>0x0, @multicast2, @loopback}, &(0x7f0000000100)=0xc)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000140)={'team0\x00', r1})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
r2 = socket$inet6(0xa, 0x3, 0x9)
getsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000000)={@mcast1, 0x5, 0x0, 0x2, 0x2, 0x2eb0, 0x6, 0x87}, &(0x7f0000000040)=0x20)

[  400.345236] binder_alloc: 9995: binder_alloc_buf failed to map page at 20001000 in userspace
[  400.350856] device lo entered promiscuous mode
[  400.353884] binder: 9993:9996 ioctl c0306201 20000440 returned -14
[  400.360567] device lo left promiscuous mode
[  400.369064] device lo entered promiscuous mode
03:36:08 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
quotactl(0x0, &(0x7f0000000040)='./file0/file0\x00', 0x0, &(0x7f0000000100))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:08 executing program 4:
r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0)
getsockopt$EBT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000180)={'broute\x00'}, &(0x7f0000000200)=0x78)
socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000080))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz0\x00', 0x1ff)
fallocate(r1, 0x1, 0x0, 0x10000101)
ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040))
getpgid(0xffffffffffffffff)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000240)={0x2, 'ip6gre0\x00'}, 0x18)
ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, &(0x7f0000000180)={{0x2, 0x4e24, @broadcast}, {0x1, @random="59a310eebccc"}, 0x0, {0x2, 0x4e21, @broadcast}, 'team0\x00'})
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getsockopt$inet_opts(r0, 0x0, 0x9, &(0x7f0000000540)=""/4096, &(0x7f0000000280)=0x1000)
r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82)
r3 = memfd_create(&(0x7f0000000480)="00eb0c432d0174df5f00", 0x3)
pwritev(r3, &(0x7f0000000340)=[{&(0x7f0000000040)}], 0x1, 0x81806)
ioctl$UI_END_FF_UPLOAD(r3, 0x406855c9, &(0x7f0000000380)={0x10, 0x8001, {0x57, 0x0, 0x6, {0x0, 0xfc}, {0x2, 0x2}, @ramp={0x9, 0x2, {0x3, 0x6, 0x5, 0x7}}}, {0x53, 0x0, 0x5, {0x3, 0x6d}, {0x100, 0x1}, @period={0x0, 0x80000001, 0x100, 0xfffffffffffffffc, 0x0, {0x3, 0x7, 0x3, 0xfffffffffffffe01}, 0x1, &(0x7f00000002c0)=[0x8001]}}})
ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3)
sendfile(r2, r2, &(0x7f0000000000), 0x2000005)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f00000000c0)={0x3, 0x1, 0xffffffffffffffff, 0x3, 0x9})
creat(&(0x7f0000000040)='./file0\x00', 0x0)

[  400.374767] device lo entered promiscuous mode
03:36:08 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0)

03:36:08 executing program 5:
r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/checkreqprot\x00', 0x800, 0x0)
ioctl$FUSE_DEV_IOC_CLONE(r2, 0x8004e500, &(0x7f0000000100)=r0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
r3 = getpgrp(0xffffffffffffffff)
getpgrp(r3)
capset(&(0x7f0000000000)={0x399f1336, r3}, &(0x7f0000000040)={0x8, 0x81, 0x101, 0x8, 0x0, 0x4})

03:36:08 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  400.383632] device lo left promiscuous mode
[  400.467758] binder: 10010:10021 ioctl c0306201 20000440 returned -14
[  400.469874] device lo entered promiscuous mode
03:36:08 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:08 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000400)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
ioctl$sock_inet_SIOCGIFNETMASK(r1, 0x891b, &(0x7f0000000040)={'veth0_to_team\x00', {0x2, 0x4e20, @broadcast}})

03:36:08 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  400.518702] device lo left promiscuous mode
[  400.521320] device lo entered promiscuous mode
[  400.530295] device lo left promiscuous mode
[  400.538637] binder: 10032:10036 ioctl c0306201 20000440 returned -14
[  400.589914] device lo entered promiscuous mode
[  400.594592] device lo left promiscuous mode
[  400.605300] device lo entered promiscuous mode
[  400.612472] device lo left promiscuous mode
[  400.629564] binder: 10052:10056 ioctl c0306201 20000440 returned -14
[  400.681770] device lo entered promiscuous mode
[  400.684656] binder: 10059:10063 ioctl c0306201 20000440 returned -14
[  400.692582] device lo left promiscuous mode
[  400.694606] device lo entered promiscuous mode
[  400.713531] device lo left promiscuous mode
[  400.790306] binder: 9995:9997 transaction failed 29201/-12, size 4096-0 line 3136
[  400.808087] binder_alloc: binder_alloc_mmap_handler: 9995 20001000-20004000 already mapped failed -16
[  400.817866] binder: BINDER_SET_CONTEXT_MGR already set
03:36:08 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c\x00D\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

03:36:08 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
connect$unix(r1, &(0x7f0000000040)=@file={0x1, './file0\x00'}, 0x6e)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:08 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = dup3(r3, r0, 0x80000)
mq_getsetattr(r4, &(0x7f0000000200)={0x1f, 0xc97, 0x92, 0x386, 0x80000000, 0x5, 0x3d05, 0x80000000}, &(0x7f0000000280))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r5)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:36:08 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  400.823265] binder: 9995:10076 ioctl 40046207 0 returned -16
[  400.831706] binder: undelivered TRANSACTION_ERROR: 29201
[  400.852070] device lo left promiscuous mode
[  400.865903] binder: 10082:10084 ioctl c0306201 20000440 returned -14
[  400.871878] binder: 10083:10086 unknown command 1140876032
[  400.871886] binder: 10083:10086 ioctl c0306201 20000440 returned -22
[  400.872678] binder_alloc: binder_alloc_mmap_handler: 10083 20001000-20004000 already mapped failed -16
[  400.879069] binder: BINDER_SET_CONTEXT_MGR already set
[  400.879078] binder: 10083:10087 ioctl 40046207 0 returned -16
[  400.987130] device lo entered promiscuous mode
[  401.000102] device lo left promiscuous mode
03:36:08 executing program 4:
r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0)
getsockopt$EBT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000180)={'broute\x00'}, &(0x7f0000000200)=0x78)
socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000080))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz0\x00', 0x1ff)
fallocate(r1, 0x1, 0x0, 0x10000101)
ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040))
getpgid(0xffffffffffffffff)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000240)={0x2, 'ip6gre0\x00'}, 0x18)
ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, &(0x7f0000000180)={{0x2, 0x4e24, @broadcast}, {0x1, @random="59a310eebccc"}, 0x0, {0x2, 0x4e21, @broadcast}, 'team0\x00'})
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getsockopt$inet_opts(r0, 0x0, 0x9, &(0x7f0000000540)=""/4096, &(0x7f0000000280)=0x1000)
r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82)
r3 = memfd_create(&(0x7f0000000480)="00eb0c432d0174df5f00", 0x3)
pwritev(r3, &(0x7f0000000340)=[{&(0x7f0000000040)}], 0x1, 0x81806)
ioctl$UI_END_FF_UPLOAD(r3, 0x406855c9, &(0x7f0000000380)={0x10, 0x8001, {0x57, 0x0, 0x6, {0x0, 0xfc}, {0x2, 0x2}, @ramp={0x9, 0x2, {0x3, 0x6, 0x5, 0x7}}}, {0x53, 0x0, 0x5, {0x3, 0x6d}, {0x100, 0x1}, @period={0x0, 0x80000001, 0x100, 0xfffffffffffffffc, 0x0, {0x3, 0x7, 0x3, 0xfffffffffffffe01}, 0x1, &(0x7f00000002c0)=[0x8001]}}})
ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3)
sendfile(r2, r2, &(0x7f0000000000), 0x2000005)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f00000000c0)={0x3, 0x1, 0xffffffffffffffff, 0x3, 0x9})
creat(&(0x7f0000000040)='./file0\x00', 0x0)

03:36:08 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be"], 0x6c)

03:36:08 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff}, 0x80000)
write$selinux_user(r1, &(0x7f0000000040)={'system_u:object_r:logrotate_var_lib_t:s0', 0x20, 'root\x00'}, 0x2e)

03:36:08 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x804)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
r2 = mmap$binder(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x8, 0x80010, r0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xf0, 0x0, &(0x7f0000000480)=[@dead_binder_done, @reply={0x40406301, {0x1, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x48, 0x40, &(0x7f0000000000)=[@fd={0x66642a85, 0x0, r0, 0x0, 0x3}, @flat={0x77682a85, 0x10a, r2, 0x3}, @fd={0x66642a85, 0x0, r0, 0x0, 0x1}], &(0x7f0000000080)=[0x0, 0x20, 0x18, 0x30, 0x20, 0x18, 0x28, 0x38]}}, @transaction_sg={0x40486311, {{0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x20, &(0x7f0000000140)=[@fda={0x66646185, 0x0, 0x3, 0x1e}, @fd={0x66642a85, 0x0, r0, 0x0, 0x2}, @fd={0x66642a85, 0x0, r1}], &(0x7f00000000c0)=[0x78, 0x40, 0x48, 0x38]}, 0xffffffffffffffff}}, @decrefs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x30, &(0x7f00000001c0), &(0x7f0000000200)=[0x78, 0x38, 0x20, 0x48, 0x20, 0x30]}, 0x1}}], 0x7f, 0x0, &(0x7f0000000240)="d304ecb9b4000376bd326cdb569e9024e108860d3dd55a636bca1a02b984baffb524d56eeb46590474f2e06972205c0e1d9fde8042ebd158a3a3bc9b96acbf70b553637c9d11568e184e54b3f4d7c5903cc1157f6863f7baac845e33972e25fce1a734421b6052ebb4c7407eb6961c284063254538991ef29e1841399516ad"})

03:36:08 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:08 executing program 5:
r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000002c0)=0x9)
r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rfkill\x00', 0x40, 0x0)
ioctl$EVIOCGNAME(r2, 0x80404506, &(0x7f0000000240)=""/102)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockname(r3, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, <r4=>0xffffffffffffffff}}, &(0x7f0000000080)=0x80)
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$BLKPBSZGET(r1, 0x127b, &(0x7f0000000140))
ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000440)={'rose0\x00'})
sendto(r3, &(0x7f0000000300)="f1a2f0f68026af2f73483735a4bbdcecad64b19231e3c2bf39a7347757e7e0df0b3ab07f064075d22292a01ea49fa079924e098bc8136cacc218c3c9f1a32ad03f2a47439724be01976b71e2bf3a64d450e2595af5495f04f548e4f242390336480a8a71bbdd0d75f2257c930a4533a9048ca4cc20c54ead243c8deddfdad1b33b960f60f7f7b131a54da9", 0x8b, 0x800, &(0x7f00000003c0)=@in={0x2, 0x4e22, @local}, 0x80)

03:36:09 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:09 executing program 3:
r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000)
getsockopt$inet6_tcp_int(r0, 0x6, 0x18, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r2 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
socketpair(0x1f, 0x80a, 0x81, &(0x7f0000000300))
sendmsg$nl_route(r6, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRESDEC=r5], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r7 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r1, 0x4c00, r7)
ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2)
ioctl$sock_proto_private(r4, 0x89ea, &(0x7f0000000180)="de70fdfc85d0ab")

[  401.157465] binder: 10097:10100 transaction failed 29189/-22, size 0-0 line 3013
[  401.166855] device lo entered promiscuous mode
[  401.171713] device lo entered promiscuous mode
[  401.173862] device lo left promiscuous mode
03:36:09 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f00000001c0)={0x8, {{0xa, 0x4e24, 0x6, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x10}}, 0x3f}}, 0x0, 0x6, [{{0xa, 0x4e24, 0x5, @local, 0x5}}, {{0xa, 0x4e26, 0x5, @loopback, 0xaa1}}, {{0xa, 0x4e20, 0x101, @remote, 0x19b97503}}, {{0xa, 0x4e22, 0x35, @loopback, 0x705b}}, {{0xa, 0x4e23, 0x6, @loopback, 0x6}}, {{0xa, 0x4e20, 0x5, @dev={0xfe, 0x80, [], 0x1a}, 0x7}}]}, 0x390)
write$P9_RUNLINKAT(r1, &(0x7f0000000080)={0x7, 0x4d, 0x2}, 0x7)
r2 = geteuid()
setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000580)={'filter\x00', 0x7, 0x4, 0x4a8, 0x140, 0x0, 0x0, 0x3c0, 0x3c0, 0x3c0, 0x4, &(0x7f0000000040), {[{{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev={[], 0x11}, @empty, @local, @loopback, 0xf, 0x1}}}, {{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}, @mac=@local, @multicast2, @rand_addr=0x3, 0xf, 0xffffffff}}}, {{@arp={@empty, @local, 0xff, 0xff, @mac=@random="d7ba3427234f", {[0x0, 0xd3e608ebc0ad6aa8, 0xff, 0x0, 0x0, 0xff]}, @mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, {[0x0, 0xff, 0xff]}, 0x7fffffff, 0x3, 0x2, 0xfffffffffffffff8, 0xffff, 0x2, 'bond_slave_1\x00', 'dummy0\x00', {0xff}, {0xff}, 0x0, 0x14}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@random="8a5a9375eaa6", @mac=@local, @empty, @loopback, 0x2, 0xffffffff}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4f8)
ioctl$TUNSETOWNER(r1, 0x400454cc, r2)
ioctl$KDSETLED(r1, 0x4b32, 0x6)

[  401.176163] binder: 10096:10104 ioctl c0306201 20000440 returned -14
[  401.181754] device lo entered promiscuous mode
[  401.191574] device lo left promiscuous mode
[  401.218706] binder: 10097:10108 BC_DEAD_BINDER_DONE 0000000000000000 not found
[  401.218716] binder: 10097:10108 got reply transaction with no transaction stack
[  401.218725] binder: 10097:10108 transaction failed 29201/-71, size 72-64 line 2921
[  401.264457] device lo entered promiscuous mode
[  401.266174] binder: 10113:10119 transaction failed 29189/-22, size 0-0 line 3013
[  401.266373] binder: undelivered TRANSACTION_ERROR: 29189
[  401.269204] device lo left promiscuous mode
[  401.283965] device lo entered promiscuous mode
[  401.303836] device lo left promiscuous mode
[  401.376910] binder_alloc: binder_alloc_mmap_handler: 10097 20001000-20004000 already mapped failed -16
[  401.389907] binder: BINDER_SET_CONTEXT_MGR already set
[  401.395476] binder: 10097:10108 ioctl 40046207 0 returned -16
[  401.401750] binder: 10097:10100 transaction failed 29189/-22, size 0-0 line 3013
[  401.404860] binder: undelivered TRANSACTION_ERROR: 29189
[  401.415443] binder: undelivered TRANSACTION_ERROR: 29189
03:36:09 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:09 executing program 5:
r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/autofs\x00', 0x400000, 0x0)
ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0)
r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$FIBMAP(r2, 0x1, &(0x7f0000000000)=0x8001)
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:09 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:09 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
flock(r0, 0xa)
flock(r0, 0x2)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:09 executing program 4:
r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0)
getsockopt$EBT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000180)={'broute\x00'}, &(0x7f0000000200)=0x78)
socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000080))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz0\x00', 0x1ff)
fallocate(r1, 0x1, 0x0, 0x10000101)
ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040))
getpgid(0xffffffffffffffff)
setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000240)={0x2, 'ip6gre0\x00'}, 0x18)
ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, &(0x7f0000000180)={{0x2, 0x4e24, @broadcast}, {0x1, @random="59a310eebccc"}, 0x0, {0x2, 0x4e21, @broadcast}, 'team0\x00'})
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
getsockopt$inet_opts(r0, 0x0, 0x9, &(0x7f0000000540)=""/4096, &(0x7f0000000280)=0x1000)
r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82)
r3 = memfd_create(&(0x7f0000000480)="00eb0c432d0174df5f00", 0x3)
pwritev(r3, &(0x7f0000000340)=[{&(0x7f0000000040)}], 0x1, 0x81806)
ioctl$UI_END_FF_UPLOAD(r3, 0x406855c9, &(0x7f0000000380)={0x10, 0x8001, {0x57, 0x0, 0x6, {0x0, 0xfc}, {0x2, 0x2}, @ramp={0x9, 0x2, {0x3, 0x6, 0x5, 0x7}}}, {0x53, 0x0, 0x5, {0x3, 0x6d}, {0x100, 0x1}, @period={0x0, 0x80000001, 0x100, 0xfffffffffffffffc, 0x0, {0x3, 0x7, 0x3, 0xfffffffffffffe01}, 0x1, &(0x7f00000002c0)=[0x8001]}}})
ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3)
sendfile(r2, r2, &(0x7f0000000000), 0x2000005)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f00000000c0)={0x3, 0x1, 0xffffffffffffffff, 0x3, 0x9})
creat(&(0x7f0000000040)='./file0\x00', 0x0)

03:36:09 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
mincore(&(0x7f0000ffe000/0x1000)=nil, 0x1000, &(0x7f0000000000)=""/105)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:09 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  401.528397] device lo entered promiscuous mode
[  401.531358] binder_alloc: 10138: binder_alloc_buf failed to map page at 20001000 in userspace
03:36:09 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x101000, 0x0)
r3 = syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00')
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000001c0)={{{@in=@rand_addr, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in=@loopback}, 0x0, @in=@rand_addr}}, &(0x7f00000002c0)=0xffffffffffffff28)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000740)={{{@in=@loopback, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0}}, {{@in6=@local}, 0x0, @in=@dev}}, &(0x7f0000000300)=0xffffffffffffffcc)
getsockname$packet(r0, &(0x7f0000000580)={0x11, 0x0, <r6=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000005c0)=0x14)
accept4$packet(0xffffffffffffffff, &(0x7f0000000880)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000008c0)=0x14, 0x800)
ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000900)={'team0\x00', <r8=>0x0})
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000980)={'tunl0\x00', <r9=>0x0})
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000009c0)={{{@in6=@mcast2, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r10=>0x0}}, {{@in6=@local}, 0x0, @in6=@local}}, &(0x7f0000000ac0)=0xfffffffffffffd4e)
getsockname$packet(0xffffffffffffff9c, &(0x7f0000000bc0)={0x11, 0x0, <r11=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000c00)=0x14)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000c40)={'nr0\x00', <r12=>0x0})
getsockname(r1, &(0x7f0000000c80)=@can={0x1d, <r13=>0x0}, &(0x7f0000000d00)=0x80)
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000d40)={{{@in=@loopback, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r14=>0x0}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000000e40)=0xe8)
ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e80)={'team0\x00', <r15=>0x0})
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in6=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r16=>0x0}}, {{@in=@loopback}, 0x0, @in6=@local}}, &(0x7f0000001140)=0xe8)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000005040)={'yam0\x00', <r17=>0x0})
ioctl$sock_SIOCGIFINDEX(0xffffffffffffff9c, 0x8933, &(0x7f0000005080)={'rose0\x00', <r18=>0x0})
getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000050c0)={<r19=>0x0, @local, @remote}, &(0x7f0000005100)=0xc)
getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000005340)={<r20=>0x0, @multicast2, @remote}, &(0x7f0000005380)=0xc)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f00000053c0)={@mcast1, <r21=>0x0}, &(0x7f0000005400)=0x14)
getpeername$packet(0xffffffffffffffff, &(0x7f0000005440)={0x11, 0x0, <r22=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000005480)=0x14)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x14, &(0x7f00000054c0)={@loopback, <r23=>0x0}, &(0x7f0000005500)=0x14)
getsockname$packet(0xffffffffffffff9c, &(0x7f0000005600)={0x11, 0x0, <r24=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000005640)=0x14)
sendmsg$TEAM_CMD_NOOP(r2, &(0x7f0000005dc0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x801000}, 0xc, &(0x7f0000005d80)={&(0x7f0000005680)={0x6f4, r3, 0x100, 0x70bd2a, 0x25dfdbfc, {}, [{{0x8, 0x1, r4}, {0x1dc, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r5}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffff9}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r6}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x64a}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x1}}}, {0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}]}}, {{0x8, 0x1, r9}, {0x198, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r11}}}, {0x74, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x44, 0x4, [{0x8, 0xef, 0x6, 0x8000}, {0x4, 0x4, 0x10, 0x817}, {0x7, 0x1, 0x7f, 0xffffffff}, {0x100000001, 0x5, 0x5, 0x8}, {0x8, 0x3ff, 0xa0, 0x5}, {0x6, 0xff, 0x9, 0x7fff}, {0x10001, 0x1, 0x5}, {0x9, 0x9, 0xffffffffffffffff, 0x8}]}}}]}}, {{0x8, 0x1, r12}, {0x44, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x3ff}}, {0x8, 0x6, r13}}}]}}, {{0x8, 0x1, r14}, {0xf8, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r15}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r16}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffff7}}, {0x8, 0x6, r17}}}]}}, {{0x8, 0x1, r18}, {0x84, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r19}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x401}}, {0x8, 0x6, r20}}}]}}, {{0x8, 0x1, r21}, {0x17c, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r22}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r23}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r24}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x8f}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x8}}}]}}]}, 0x6f4}, 0x1, 0x0, 0x0, 0x8000}, 0x800)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0063404000000000000000aa00000000000000000000000000000000000000000000000000000000000000000000000000000000191fe2f4f319e87046ec788204fb6c34c9b9e487ae136ef98396a6b7f55c970ccfb08cfaf27856247625aa323ddeee6b91013b538187a1b38b44237e7388cee5845730188e3c25ea2d685cbcfd142c1586da4d72322f9ffab83c5310385cd255710000000000000003037d0fd967da2baac65deaa2dc28901a79e7bfed23a3d0e211f12675ee87341c2a3b06c378fd664303de623c027ba120f9b6918e0064bd2f6347925e88c4c3d55cbfe1d4fcee296f455d170300a793eb9f5c75360dcea5", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})
r25 = dup2(r0, r1)
ioctl$BINDER_WRITE_READ(r25, 0xc0306201, &(0x7f0000000080)={0x2c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0f630c400500000004000000000000000e630c40040000000300000000000000106308400400000000000000"], 0x22, 0x0, &(0x7f0000000040)="c880d55c1ed6552052f2dd82fb25534003521049004ff151a13ce34cf2b487d55bb2"})

[  401.534364] binder: 10138:10143 transaction failed 29201/-12, size 0-0 line 3136
[  401.536237] binder_alloc: 10138: binder_alloc_buf failed to map page at 20001000 in userspace
[  401.536276] binder: 10140:10142 transaction failed 29201/-12, size 0-0 line 3136
[  401.536727] binder: undelivered TRANSACTION_ERROR: 29201
[  401.539249] binder_alloc: binder_alloc_mmap_handler: 10138 20001000-20004000 already mapped failed -16
[  401.549125] binder: BINDER_SET_CONTEXT_MGR already set
[  401.549134] binder: 10138:10143 ioctl 40046207 0 returned -16
[  401.550814] binder_alloc: 10138: binder_alloc_buf, no vma
[  401.550834] binder: 10138:10147 transaction failed 29189/-3, size 0-0 line 3136
[  401.551206] binder: undelivered TRANSACTION_ERROR: 29189
[  401.551322] binder: undelivered TRANSACTION_ERROR: 29201
[  401.598780] binder: 10149:10152 transaction failed 29189/-22, size 0-0 line 3013
[  401.598974] binder: undelivered TRANSACTION_ERROR: 29189
[  401.625863] binder_alloc: 10155: binder_alloc_buf, no vma
[  401.625882] binder: 10155:10156 transaction failed 29189/-3, size 0-0 line 3136
[  401.656121] binder_alloc: 10155: binder_alloc_buf, no vma
[  401.656142] binder: 10155:10162 transaction failed 29189/-3, size 0-0 line 3136
[  401.656326] binder: 10155:10162 BC_CLEAR_DEATH_NOTIFICATION invalid ref 5
[  401.656338] binder: 10155:10162 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4
[  401.656348] binder: 10155:10162 BC_DEAD_BINDER_DONE 0000000000000004 not found
[  401.656807] binder: undelivered TRANSACTION_ERROR: 29189
[  401.656830] binder: undelivered TRANSACTION_ERROR: 29189
[  401.770384] device lo left promiscuous mode
[  401.776400] device lo left promiscuous mode
[  401.827818] device lo entered promiscuous mode
[  401.836784] device lo left promiscuous mode
[  401.843120] device lo entered promiscuous mode
[  401.854362] device lo left promiscuous mode
03:36:09 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x2, 0x0)
accept4$packet(0xffffffffffffff9c, &(0x7f0000000040)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14, 0x80000)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000140)={{{@in6=@local, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}}, &(0x7f00000000c0)=0xe8)
setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000480)={{{@in=@loopback, @in=@multicast1, 0x4e24, 0x5, 0x4e21, 0x1, 0x0, 0xa0, 0x0, 0x33, r3, r4}, {0x3, 0x6, 0x1, 0x8, 0x7, 0x2, 0xffffffffb625a27b, 0x3}, {0x3ff, 0x3f, 0x8a37, 0x9}, 0x2, 0x6e6bc0, 0x1, 0x0, 0x1, 0x3}, {{@in=@multicast2, 0x4d3, 0x3c}, 0x2, @in=@dev={0xac, 0x14, 0x14, 0x1c}, 0x3502, 0x3, 0x1, 0x5, 0x1000, 0xfffffffffffffe01, 0xca76}}, 0xe8)

03:36:09 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:09 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f757024"], 0x7e)

03:36:09 executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:09 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/mls\x00', 0x0, 0x0)
r2 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
ioctl$ASHMEM_GET_NAME(r1, 0x81007702, &(0x7f0000000400)=""/4096)
r4 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/hwrng\x00', 0x4000000000003fff, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
r5 = socket$packet(0x11, 0x3, 0x300)
syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r5)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r2)

03:36:09 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000001c0)={{{@in6=@dev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0}}, {{@in6}, 0x0, @in6=@remote}}, &(0x7f0000000000)=0xe8)
setuid(r1)

03:36:09 executing program 5:
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='fd/4\x00')
utimensat(r0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)={{0x77359400}, {0x0, 0x2710}}, 0x100)
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x7, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
poll(&(0x7f0000000000)=[{r2, 0x41}, {r1, 0x20}, {r1, 0x100}, {r1, 0x4}], 0x4, 0x3)
socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000040)={<r3=>0xffffffffffffffff})
setsockopt$inet_mreqsrc(r3, 0x0, 0x25, &(0x7f0000000080)={@remote, @multicast2, @multicast1}, 0xc)
fchdir(r2)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:09 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:09 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  402.048848] binder_alloc: 10170: binder_alloc_buf failed to map page at 20001000 in userspace
03:36:09 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  402.059701] device lo entered promiscuous mode
03:36:10 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  402.062065] binder: 10172:10178 ioctl c0306201 20000440 returned -14
[  402.065001] device lo entered promiscuous mode
[  402.070326] device lo left promiscuous mode
[  402.074667] device lo entered promiscuous mode
[  402.080929] device lo left promiscuous mode
[  402.120122] binder: 10188:10189 ioctl c0306201 20000440 returned -14
[  402.150373] binder: 10191:10192 ioctl c0306201 20000440 returned -14
[  402.214783] binder_alloc: 10170: binder_alloc_buf failed to map page at 20001000 in userspace
[  402.224067] binder: 10170:10181 transaction failed 29201/-12, size 0-0 line 3136
[  402.234414] binder_alloc: binder_alloc_mmap_handler: 10170 20001000-20004000 already mapped failed -16
[  402.244390] binder: 10198:10199 transaction failed 29201/-12, size 0-0 line 3136
03:36:10 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:10 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  402.253165] binder: undelivered TRANSACTION_ERROR: 29201
[  402.269279] binder: BINDER_SET_CONTEXT_MGR already set
[  402.277839] binder: 10170:10202 ioctl 40046207 0 returned -16
[  402.283917] binder_alloc: 10170: binder_alloc_buf, no vma
[  402.289866] binder: 10170:10181 transaction failed 29189/-3, size 0-0 line 3136
[  402.289897] binder_alloc: 10170: binder_alloc_buf, no vma
03:36:10 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:10 executing program 6:
r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r0, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0)
sendfile(r0, r0, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  402.289915] binder: 10204:10205 transaction failed 29189/-3, size 0-0 line 3136
[  402.290372] binder: undelivered TRANSACTION_ERROR: 29189
[  402.316960] binder: undelivered TRANSACTION_ERROR: 29201
[  402.318195] binder: 10207:10209 transaction failed 29189/-22, size 0-0 line 3013
03:36:10 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x80000, 0x0)
ioctl$TCSETS(r1, 0x5402, &(0x7f0000000040)={0x9, 0x6, 0x4, 0x3, 0x6, 0x2, 0x101, 0x8, 0x7, 0x101, 0x86a, 0x6})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

[  402.318388] binder: undelivered TRANSACTION_ERROR: 29189
[  402.347144] binder: 10211:10212 ioctl c0306201 20000440 returned -14
[  402.376640] device lo left promiscuous mode
03:36:10 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
getsockname$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000080)=0x1c)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x18, 0x0, &(0x7f00000000c0)=[@enter_looper, @register_looper, @clear_death={0x400c630f, 0x2, 0x3}], 0xad, 0x0, &(0x7f0000000240)="7b59255dfc199524e8ab76697e08dc5a2fcade2a5b3f37026bd86837a52ecdf6ad7ba54cd5381846c9119ec4aa22fc5d19386b9b051c11b8b6e3069216d09cd5b64b6df019c7871620be9b077b9a4616dc779657fb79aafb1d02a20ce3ff87c30620fee3d0fee29d5f6c85ff443ab4eebf8539e010667e0b2b1ed9cc6f690c9e9d8b3b24535745f4c26a48fc461bd97e9873792c33c2d484f359c30bb769d2d0a2eed927f107835affebeabe5d"})
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
r2 = creat(&(0x7f0000000140)='./file0\x00', 0x1d)
sendmsg$nl_xfrm(r2, &(0x7f0000000200)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000480)=@getsa={0x1ec, 0x12, 0x2, 0x70bd29, 0x25dfdbfc, {@in=@rand_addr=0xff, 0x4d5, 0x2, 0x6c}, [@migrate={0x1bc, 0x11, [{@in=@local, @in=@remote, 0x3f, 0x0, 0x0, 0x3504, 0x2, 0x2}, {@in, @in6=@dev={0xfe, 0x80, [], 0xe}, 0xff, 0x3, 0x0, 0x3506, 0xa, 0x2}, {@in=@remote, @in6=@mcast2, 0x0, 0x1, 0x0, 0x3500, 0x2, 0x2}, {@in6=@mcast2, @in6=@ipv4={[], [], @rand_addr=0x1}, 0x33, 0x4, 0x0, 0x3506, 0x2, 0xa}, {@in6, @in=@multicast1, 0x33, 0x7, 0x0, 0x3506, 0x0, 0xa}, {@in6=@local, @in6=@remote, 0x32, 0x3, 0x0, 0x3500, 0xa, 0xa}, {@in=@rand_addr=0x9, @in=@local, 0xff, 0x7, 0x0, 0x3507, 0x2, 0x2}, {@in6, @in6=@mcast2, 0x6c, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in=@rand_addr=0x6, @in, 0x6c, 0x7, 0x0, 0x3506, 0xa, 0x2}, {@in6=@mcast1, @in=@remote, 0x3c, 0x0, 0x0, 0x3502, 0xa, 0xa}]}, @extra_flags={0x8, 0x18, 0x5}]}, 0x1ec}, 0x1, 0x0, 0x0, 0x4000000}, 0x80)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:10 executing program 6:
r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r0, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0)
sendfile(r0, r0, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  402.400859] device lo entered promiscuous mode
[  402.403961] device lo entered promiscuous mode
[  402.407431] device lo left promiscuous mode
[  402.425895] binder: undelivered TRANSACTION_ERROR: 29189
[  402.465706] binder: 10223:10225 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER
[  402.485293] binder: 10223:10225 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2
[  402.503306] binder: 10223:10225 transaction failed 29189/-22, size 0-0 line 3013
[  402.511918] binder: 10223:10225 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER
[  402.520741] binder: 10223:10225 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2
[  402.527787] binder: BINDER_SET_CONTEXT_MGR already set
[  402.533171] binder: 10223:10228 ioctl 40046207 0 returned -16
[  402.540133] binder: undelivered TRANSACTION_ERROR: 29189
[  402.548455] device lo left promiscuous mode
[  402.568961] device lo entered promiscuous mode
[  402.579916] device lo left promiscuous mode
03:36:10 executing program 4:
r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000)
getsockopt$inet6_tcp_int(r0, 0x6, 0x18, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r2 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
socketpair(0x1f, 0x80a, 0x81, &(0x7f0000000300))
sendmsg$nl_route(r6, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRESDEC=r5], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r7 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r1, 0x4c00, r7)
ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2)
ioctl$sock_proto_private(r4, 0x89ea, &(0x7f0000000180)="de70fdfc85d0ab")

03:36:10 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f757024"], 0x7e)

03:36:10 executing program 6:
r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r0, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0)
sendfile(r0, r0, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:10 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0)
accept$packet(r2, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x802)
ioctl$KIOCSOUND(r2, 0x4b2f, 0x7e0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:10 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x3a000)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

[  402.896418] binder_alloc: 10236: binder_alloc_buf failed to map page at 20001000 in userspace
[  402.905357] binder: 10236:10237 transaction failed 29201/-12, size 0-0 line 3136
[  402.914347] binder_alloc: binder_alloc_mmap_handler: 10236 20001000-20004000 already mapped failed -16
[  402.924717] binder: BINDER_SET_CONTEXT_MGR already set
[  402.926435] device lo entered promiscuous mode
[  402.930650] device lo left promiscuous mode
[  402.939075] binder: 10236:10241 ioctl 40046207 0 returned -16
[  402.945972] binder: undelivered TRANSACTION_ERROR: 29201
[  403.040584] device lo entered promiscuous mode
[  403.048261] device lo left promiscuous mode
[  403.351239] IPVS: Creating netns size=2536 id=94
[  403.539992] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  403.578786] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  403.640278] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  403.654126] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  403.716249] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  403.730680] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  403.745880] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  403.764187] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  404.436420] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  404.470974] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  404.477703] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  404.484354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:36:13 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:13 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="030000f3ffffff000800fce4cafe61aaa4031b0008000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:36:13 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:13 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x220000, 0x0)
getsockopt$inet6_mreq(r1, 0x29, 0x0, &(0x7f0000000040), &(0x7f0000000080)=0x14)
ioctl$SG_SCSI_RESET(r1, 0x2284, 0x0)

03:36:13 executing program 4:
r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000)
getsockopt$inet6_tcp_int(r0, 0x6, 0x18, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r2 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
socketpair(0x1f, 0x80a, 0x81, &(0x7f0000000300))
sendmsg$nl_route(r6, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRESDEC=r5], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r7 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r1, 0x4c00, r7)
ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2)
ioctl$sock_proto_private(r4, 0x89ea, &(0x7f0000000180)="de70fdfc85d0ab")

03:36:13 executing program 5:
r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x6, 0x100, 0x0, 0xe, 0x1a, 0x9, "c6abd4925f3295818a2aa826de1d85bbdbef2e271c45892ea4f9efdb0aa27d5e8ca23a7fa1fa3956c737b6449b4ff1b0c0dd673440c18581ab3ab03b710dae3e", "36c0a292d253b736524bcf9c2ac09f2a1ecf0bf1911f0bd84988b61efe27a3a71482ad21fc0f4553a8160de1ddeefb4f153f4cdb762e8c58264d443cbd00199a", "cac35c7f13764c88b04544f5dcc7e2aadde962528fc63adcf26b64a77505aa1f", [0x2, 0x1]})
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0xfffffffffffffffe, 0x80000)
r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x600400, 0x0)
ioctl$RTC_WIE_ON(r1, 0x700f)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
clock_gettime(0x3, &(0x7f0000000080))
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000040)={"6c6f00000000000000000000000200"})
setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000540)={'filter\x00', 0x7, 0x4, 0x4a8, 0x140, 0x140, 0x280, 0x3c0, 0x3c0, 0x3c0, 0x4, &(0x7f0000000000), {[{{@arp={@multicast2, @remote, 0xffffff00, 0x0, @mac=@local, {[0xff, 0x0, 0xff, 0x0, 0xff]}, @mac=@random="fb9fa4ec2ee1", {[0xff, 0x0, 0x0, 0xff, 0x0, 0xff]}, 0x3, 0xfff, 0x5, 0x8, 0xb724, 0x9ef, 'bridge0\x00', 'rose0\x00', {0xff}, {0xff}, 0x0, 0x100}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @dev={0xac, 0x14, 0x14, 0x15}, @dev={0xac, 0x14, 0x14, 0x12}, 0x4, 0x1}}}, {{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @remote, @loopback, 0x2, 0xffffffff}}}, {{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@broadcast, @empty, @loopback, 0x0, 0x1}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4f8)

03:36:13 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f757024"], 0x7e)

03:36:13 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = memfd_create(&(0x7f0000000000)='/dev/binder#\x00', 0x2)
fcntl$getownex(r2, 0x10, &(0x7f00000001c0)={0x0, <r3=>0x0})
getpgrp(r3)
getsockopt$EBT_SO_GET_INIT_INFO(r2, 0x0, 0x82, &(0x7f0000000040)={'filter\x00'}, &(0x7f00000000c0)=0x78)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000050000000000000000000000ffffffffffff0fe0000000000000000000b10000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

03:36:13 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:13 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4d, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000009867ebcc0000000000000000000008000000000000000000020000000000d3e214067545b9a3ae", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYRES64=r0], 0x0, 0x0, &(0x7f0000000200)})
r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x200, 0x0)
mq_notify(r2, &(0x7f00000001c0)={0x0, 0x21, 0x4, @thr={&(0x7f0000000480)="690a50e76b756f543c43745dd095909e28e59c2ed888e6a91fc31b13597ec80a9389fab57ec559f04faa5dab1fe7d33706e625f869276806274c56c4c78691842e56fc96d5cf6be1d9949e0184dfd029dfb0d60423b550852e658990b4651f4e2de02d24f1c494fd67126d1aa35fb84e1db93ffa22893451775e966d46c3af21821b0233bb0e78d2f9de40def414c39bb45ebc3a4a9e7bb97c821b63a827a37bd55e2d4e5a2bd84b37870ebbb8102e05d3086fcdfed3a282510c9351555ac1b28b77f4d69d2a7843ca093249c56ca9837c466cd3dfcf21a6787d150936e5f0da164fd98967fb912af6de0d411d053d9f8c7d55307f4b3d836f3622c170c4037e9f502ddc6c242e0b15402e87f9220524d26567691fd61174714dfb2b40d628a66fc5bb527a45780071a7da3bd2f48543a5d99fd72d141c556afaa67aadc1f4b6368ea92c18680b390409e9b6304c85d6bfe245bc1b0eb07c47589fca1f5dac3f92ec4e73905ed9a3dd74594cfbfd626569075fc6976bf0c8c03c976173666a6fb7f089e1e9fcb12659fbb9965930820cdf60a811ba80d0c94a0b4bd052aa06931e67bb9315ac54ed7ecf4dd3ed5dcd417898ef29445b97128f039600d355800a966ede75f660fa43f90389925323e34179ead680d813e5f1fdf6db4ee5ffb1b19a795bbe1cba7f6458c14367cdaad63c95e0e8b4ea623c2bd7c781370e856bd790d813b0d4d7f0995643dbf026c437ff45affc68bc86f7101f1bb573409cd1dc847a3082708999ef528c2866a0aff732d27cd29086a822c1e8c9186a0ff378263ea68f0be955451b76c1920146873277ed657e290d4e443221c1f16ef7aafceee10fc9b0318b63ecbfbcb5705faffbd4252e1b27fc7607f867f887b2cac308f5ef64bddd8bf15b40721ee7b749469e7156dde9f3095102d972b0bf801ceab5b062dbf67ee02562aa5de80ccfaf22d3e644f46cde4865328352086002390dabfb22a6bde1eed859ff25fc1e3a5f8ca39dc4d56800fe2ab272a28f71d0560244665c7b1e928f50e6ded03dd4cf62a89a650f57b3a55c9774fce77325eb8e7025ac9ac22f42dfc2ad73b2e68239483d8b3edfffa51284765941a6e995304ae877c3763a85999334c9c11a52657ae0ea1f4d22f14e10519130116d68965f4c908a0d81ac053a8b18d2189ff50a35704c9205a494d60e5727d9b452998203c64905d2c81a41eb4d3b595a724f49ea90fccfce544978e8874300d539bae7f64688556b99e080956d747678a0423459a65007aecf8e3ceaf2a747c53a189894793dfdd400000a015c148b07e35c66f0cca2c17492a897128c90a2a902fcb22b2c5b6265d29268fc3c22090ff7ab545bff9b731503816c554cdfa0193bbd5d92a1cafc5a8e4eb652fcb0500b6e5b25ca00d80f24c6058cd9135f1930e91b0e267a693cb9cccbeac951b185f3cc344713485bb19e458aec739e77d43c7749e7558ec84821acbd759c737eba5345307ce9532d29f0ae4dba5eac7926c6b7f6a14a7a919bbac67eaf6acbd1f589d3b0cf630923cd1fed6a60f09cc843aadf202d18bbdb2423deb844abe547c12ff82d89a9c8fd484a81c483fe71444c797527c38a8761d9544984cbe97220325261622187a63eba27e76c71073d8f365f42b8ac434d1f7646545e9a263f37c3bd87cd1ade1babb5ea3a7f29184fa147acc9d4ca5e9bc990a3845b58c99df07d6165b86d12da28308794edba6472441b70077f5e1e1f0891627ac05ff747a81f13382274a6d93f3c52387742c0a4ff89c3bb2edb42b5b68872ffbd836dff75097719f5eabd494e4f80ad38a9332e8434d7fb2c368020f457d444026bdb4cf776f939958346e231660cf615be73c725f15ce3b600d2eb9894866bccdf49af9257f6048cc604f214f6ab127a230c0140cdddfcf89b5ed32fd068e21cad40b2493bf690615975564619032384cbc8223f8867198e5ed4923fc1bf85075d16323b0667cbdaa2a374a7affb4697951c7aa2319fbbf7c26e18304b3cd4eda7fc2010a7d5554cee1c90e0251bda2b6cf14d18ec15570ad0e027217e7d047c6a7653a9fbb9fc12bf5b5b6b97e4ecfd44e00c9dc5b61c4daeb39b2f93ca68158227d9e9bcbbb33bd8046e26b660f0b7aa519f8e6d5a2bd1b7ede4d6143c5343799ed42f066d1f221ea8e4772b1a1a97cf10fea11f0b74cc201619abb322131635e55637932c834f87361c930a5a55b058b8baed11b2b697272511de8cf45bad67bb2418305fb8088100aafbbc5a8cf8a5f2a9c8c2411212b3416d2fcec376fc4375be86339911430be4ba85cd15f3cf904bb78686b23f77b7e83e9e67c6c198203e47dd93ce979577b202bc2f6f0c3f660a905801bd5e6c241c350f61767af60160ee702b054f8b5acb91e55039a635de43c464ba87f68365a9f8b40303d31ed752390e47e443e0b398dd706c0041877adbbba02270e1bf9c47bc34bfe169b7e6b6003ff026193dd555f156577b36d91cc0b70f49ff745f7e2624e56c0bbf8bddea88624cf52746afd39999c04ebb7c5bc83f1bdcd041e980ba71751aaf7673616c007b0285c3e1defa3f4932480fce7aa72971a89aace16ea63eadf5851ab4a89f60da0049d52a3e00644e30c46c9d6d0cbaaedbec8e934b37b7326dbc170f65a568b240db36fcd0fc8fbdb07cfc1f3071f9f35e2fc547c42bd9115911185eaadc422e80c048c3be9919a4ab5ddb7f0ce763383a76849767634a96429b3bec89159ce74f064a257017312cba73f09d0203a1bc4d28fdebe92efa624e32565475908d005a4ae850f9bcf011b826879ee6f992c2766173a1b546d79e2ff1089f9ead16c107ed4b846310ee6c300579ffd4615932dfab1edbabed853d932b69ddd63dd15ee59f4b637c0f06490046372c7c2b027578a4fff726d7f41716c5cb25f3ae713ad5d8e20144db25095a06adba536e0ac6311ed272957a2ad2149a5d92f55391e62d5bd684e6ddcdf50ee63cc506472ece342c1a8c1822d7788b8407e53b423bc11bfa0ead3b2faee24d8854e720634687beb4a85713eaa743dfc392310586a98c1fe27f4d7de0bfe36cafc2711764ca53e0365770e8d077a599060b433a30ff9498f27e0698115e07f1cf93e1de32de5f286119fd66de47ffef30703412c08ad4555f6c09d0a4b3c8774101e69f2d1613b399c2a038375a57d77abea7dd2dd625900df6ea54b702060e3c316ea92e05187f665a70a199204fe2aafc7b60c2d184372f3778a63dd3d677396047219ba18be5dc22b10d74c4094cd4640e7fb5394a5abc85b39004486018584c4601ae4f94abb7977f480110e5eac4bd937154adfaed4b5ca7c787d1814d4b737953ac63dbe5a2bb55ab0ac23900ce7119af8faa7bc35c73ca5fb1bc97c7470063ae7b5e17915ce48e67aca5c891c4fbb55421de480c829587525234da8bee910cd92ef85127cbc3edf4bc8eb46887646a10773fcb9db66195714c1ea86a06a3794ff5deda802685ca3d4f44ccc309def88746e51e3b5f5ee9faf59bf77bec50a0a60bb3e8041ba63034a9b50dda90a0acc3e25b96d3fc5c803951dc05b5b3f9ca8f4066109b15a55e4e9e4e45a24a28ba834616551fca8bcb87d2c5dac3d347fe7e017e1fad351b20a6a19f2108cd8dd6d7ae9bfbd6ce2c1c6dfd867c2fd4734b081178afaccd5d3af967a3785220f8ebf317705782f63bfb8f366d40eb64c392f4ca868da60b2607954dc464adb6284ab7240b497b31053864b154c38037faed44b204231fc25499a253c9d35c936cf41120b534f0745e296a8cb5ffcf3e7e4f235ee71067def52a017c254875e88187606b1525adfd50aacbc1b19d9aa44c6ab23f4573f8b84279b848c5a92c72ebdfbb8bb7f9d58fd3c1f9eb32925417f0fe5ccdcea4d2e3b772d4a1397abb0e1d55264f98d3cb83692411f48c22bc9c01b7118d353ccd2b6c4551b1f7760bc0f734fb8fd5fe031a1b3e70aca53f14352c06ed62a63fb638c7f1a9cfd2b50b33075abf08d5d47e193eebc45a6917620ab42d03eec24f95986e6553c8545ef7ee7c5078de3608bda2b8b2f2fc6eb1b4838ea21af830efbddc66dd94b08650ebe7df2354c64fbebcdd84cd4568233c9d0efd4ae558aff1259ee312ac28baa198e54679a37efd5edfa475e49deab4e12ca9d96ea261b461eb87f3a72a7b72a0c38cd2f0a3d159d45bc386bcb1d2fe7293e962d434c446fbc76852fbb48dfab26b0cbefcf95dba08d06b82a12b74e08df12dd59a5a1aa34956b91e3b6d9eb4c35650cd441f3a16da26686a09c5087bc4694d1af6841fa1bf9f8f715de0a0a9f5a92007122e5059d3f22ec1de916f5a617caf3a462ad969562589e4588eb4796949f32eb34dd380e19f1522c2e745c64ea15bd4ad6573f1daf0254a73947a6743a703b7780f5f84964bf119a8b730ce0a12f0b90b91deefd21d63000650404110fbdc3e12e9314e4fb948a8eeb0598a4a2332e65d24d3e6fcf3d7fe2a6fe48a2c092be4d5f8805486c052ba510f33a5ea750c304e8b1b2ea92b3ddf6e4c416306012495cc8613b83657278383dd98bb5d04871fc6ba2a5e00e081cb1c0a7636ab29bc3319f9400dc22dcda0b6ac08517be966f903affe80dacb240425f5f4483c205e21e7ba104e93bdb4e388c7239e8302d59ff1a3074b7db91b936c86ea50f0adebd57b6199444ebcf0393c1e923e439af68bba5274c4518b34a87926571987d4688ef5d2e1d33fe5f84ade44c047ce8139f28a801c7753c45687f66320c0825cbeb1fbfdfd47bd5d594a5c67219d23e0a9bac805459b52c1b8366b5aaea6d9cb0925b49a67ddf3ec38a270b3f680564627e32b748f710488813a52bd820e967e2b8ca566faa7641631c2c385d8fbed37be59e7c3bbd0e91f2fb70e1964919cd8f15da92dc123ec4ce4efd16abaf2178a90c7b0c5b6027513be04173364e9a644e3aa738d0ae81ade644f10842db2d4b927061872a931326010df4ddf67aaea6030e09d81ac5c607f4008a210aad674e6faccc4486f71391bb05b0d043ac46210d5c542c3fddba64140d8453e845de3da0fbf093fa8950cb70feceeca1944a95058f385170c7d94bc0ed6d4ee06e50ab5a903e80f752a2af90333b87df8849d1e4f7e12c596f69dbc2f5f4cfedfe52acf77b5351a9fbde64ccfb62afd10164744e7bce9185e188e818296c8dab41022890550508e04bd027cd19130252c60c94a74db31fef5701019aa43219784d1b0f252d9f21958d5978a61a4573eec1ca3f0ee36684748511bda39d76e3ee76fa38d92fdee881d94414f4cea4012accbeef3c8a2b0e11306bcbebbadb470beaf0cd92a41cf467307dbf2dc8fbef50f5abc009efcfe99c62ff2851a61ef8085511ff6907e6bb9b056889d5eaf54e373b1d8997bc652d800a6c9619e3339a6bf97c8e92f9c806c21fdbb280c5ce2bb7530869f0d29b9494d6ac2d957c698f71c942e10495ba28398e748b8c033ccc936430668d791bdf95d09e8dfdc8cfbdc1b7c8773be4022191014b0b84f9be6374fd09215a4f216cf5eed7ad6850bd5bd3b54b03ed0a20e5ddcafa4c329fcbd20f43ce58b17fb22326244a2fbc6afd5f16cfae1033cfe5b4d75483566a0a1a74158062d6ea34dd6f0601632f0d4be0b78db10fd4daab63cade29a13d411a4321de4c13aadb347985566108079f2bd9d3692031116d6f4173f52178e3ef80e6b377f542d3766d0a8caedd81d0cb5a01497f1fc927a5986c0b969af4e213c287b5412222a1153", &(0x7f0000000040)="2ddd9ca26c8c2f1a0fd68a3b68602b8b09da76b98865b5669e8f66dcac94a3298a553cdc20771de1106e49e9aea5259c627b7fcad2b9a4a500a106f45ef0e7dd4fe0f86689c16243769fab2900359cd92d6a9724983bea9036a07d8c5c3801041ff5b655f09194da6a9432aaa2d5ae32bf646ba589c273d6ee01e5a4093155ba1bda706bb29afdeac306fff18f8e000a975d8c3da52f7e2cce760a1930814fc4f244130564c6eda0872782d6"}})

[  405.561902] device lo entered promiscuous mode
[  405.568920] binder_alloc: 10631: binder_alloc_buf size 49822033218895872 failed, no address space
[  405.568927] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
03:36:13 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:13 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ftruncate(r1, 0x0)

[  405.568946] binder: 10631:10636 transaction failed 29201/-28, size 962341109759-49821070877786112 line 3136
[  405.571444] binder: 10629:10635 ioctl c0306201 20000440 returned -14
[  405.579688] binder_alloc: binder_alloc_mmap_handler: 10631 20001000-20004000 already mapped failed -16
03:36:13 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:13 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
socketpair$inet6(0xa, 0x0, 0x8, &(0x7f00000000c0)={<r1=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'syzkaller1\x00', <r2=>0x0})
r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200)='/dev/rtc0\x00', 0x1000004000000b00, 0x0)
ioctl$TUNGETVNETHDRSZ(r3, 0x800454d7, &(0x7f0000000040))
ioctl$sock_inet6_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000000180)={@ipv4={[], [], @multicast1}, 0x7b, r2})
r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000c9c11e00000000000000000000000000000044a5c78774dad3", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

03:36:13 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  405.579790] binder: BINDER_SET_CONTEXT_MGR already set
[  405.579798] binder: 10631:10638 ioctl 40046207 0 returned -16
[  405.580416] binder: undelivered TRANSACTION_ERROR: 29201
[  405.621633] binder: 10643:10646 transaction failed 29201/-28, size 8-131072 line 3136
03:36:13 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x800000000000802)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x100000000020011, r0, 0x0)
r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x200000, 0x0)
ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f0000000040)={0x5, 0x80})
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:13 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  405.626397] binder_alloc: binder_alloc_mmap_handler: 10643 20001000-20004000 already mapped failed -16
[  405.626794] binder: BINDER_SET_CONTEXT_MGR already set
[  405.626802] binder: 10643:10648 ioctl 40046207 0 returned -16
[  405.627294] binder_alloc: 10643: binder_alloc_buf, no vma
[  405.627322] binder: 10643:10646 transaction failed 29189/-3, size 8-131072 line 3136
[  405.627761] binder: undelivered TRANSACTION_ERROR: 29189
[  405.627852] binder: undelivered TRANSACTION_ERROR: 29201
[  405.629515] binder: 10639:10645 ioctl c0306201 20000440 returned -14
[  405.670026] binder_alloc: 10652: binder_alloc_buf failed to map page at 20001000 in userspace
[  405.670088] binder: 10652:10657 transaction failed 29201/-12, size 0-0 line 3136
[  405.671794] binder: 10650:10655 ioctl c0306201 20000440 returned -14
[  405.679907] binder_alloc: binder_alloc_mmap_handler: 10652 20001000-20004000 already mapped failed -16
[  405.680441] binder: BINDER_SET_CONTEXT_MGR already set
[  405.680450] binder: 10652:10659 ioctl 40046207 0 returned -16
[  405.680784] binder_alloc: 10652: binder_alloc_buf, no vma
[  405.680802] binder: 10652:10657 transaction failed 29189/-3, size 0-0 line 3136
[  405.681294] binder: undelivered TRANSACTION_ERROR: 29189
[  405.681367] binder: undelivered TRANSACTION_ERROR: 29201
[  405.713443] binder: 10663:10667 ioctl c0306201 20000440 returned -14
[  405.741846] binder: 10665:10668 ioctl 8933 20000140 returned -22
[  405.743150] binder_alloc: 10665: binder_alloc_buf failed to map page at 20001000 in userspace
[  405.743185] binder: 10665:10668 transaction failed 29201/-12, size 30-0 line 3136
[  405.743786] binder: 10665:10673 ioctl 8933 20000140 returned -22
[  405.749539] binder: BINDER_SET_CONTEXT_MGR already set
[  405.749547] binder: 10665:10673 ioctl 40046207 0 returned -16
[  405.749595] binder_alloc: 10665: binder_alloc_buf, no vma
[  405.749612] binder: 10665:10675 transaction failed 29189/-3, size 30-0 line 3136
[  405.749963] binder: undelivered TRANSACTION_ERROR: 29189
[  405.750028] binder: undelivered TRANSACTION_ERROR: 29201
[  405.766192] binder: 10671:10676 ioctl c0306201 20000440 returned -14
[  405.785706] binder: 10678:10680 transaction failed 29189/-22, size 0-0 line 3013
[  405.789835] binder: BINDER_SET_CONTEXT_MGR already set
[  405.789844] binder: 10678:10684 ioctl 40046207 0 returned -16
[  405.790173] binder: undelivered TRANSACTION_ERROR: 29189
[  405.809727] binder: 10681:10685 ioctl c0306201 20000440 returned -14
[  406.007461] device lo entered promiscuous mode
[  406.016595] device lo left promiscuous mode
[  406.067391] device lo left promiscuous mode
03:36:14 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

[  406.121447] device lo entered promiscuous mode
[  406.127662] device lo entered promiscuous mode
[  406.137774] device lo left promiscuous mode
03:36:14 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r2 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000000d2000200000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x1, 0x300)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r3)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff)

03:36:14 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"626f6e4c5f736c6176655f3039dd0947"})

[  406.763682] device lo entered promiscuous mode
[  410.129285] IPVS: Creating netns size=2536 id=95
[  410.163994] IPVS: Creating netns size=2536 id=96
[  410.435822] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  410.454627] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  410.463589] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  410.482951] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  410.572797] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  410.591841] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  410.600031] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  410.613697] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  410.694518] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  410.702171] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  410.716891] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  410.724512] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  410.735586] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  410.747392] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  410.760818] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  410.769348] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  411.873086] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  411.879858] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  411.931875] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  411.938155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  411.944823] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  411.953599] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  411.960994] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  411.967988] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:36:20 executing program 4:
r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000)
getsockopt$inet6_tcp_int(r0, 0x6, 0x18, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r2 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
socketpair(0x1f, 0x80a, 0x81, &(0x7f0000000300))
sendmsg$nl_route(r6, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRESDEC=r5], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r7 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r1, 0x4c00, r7)
ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2)
ioctl$sock_proto_private(r4, 0x89ea, &(0x7f0000000180)="de70fdfc85d0ab")

03:36:20 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063c05a000800000000000000000000000000000beaffffff000000000000000000009227fb732300000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

03:36:20 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c", 0x16)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:20 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/autofs\x00', 0x200, 0x0)
ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0xfffffffffffffffc, 0x1, "0fac895cc459982d99764538cb43ac533b0b9da42670bd4976d90ee17e6d77c8f82f25dd0df52b43ec336c6f82542a6be8f84444b7c42d5cd1ebd2a712f3c849", "9cb130834eea16f3f55e08726d9aa07376b66d8675d52ae643c410f6a2f88f40", [0x2, 0xff]})
open(&(0x7f0000000140)='./file0\x00', 0x400, 0x40)
r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
r3 = add_key(&(0x7f0000000340)='dns_resolver\x00', &(0x7f0000000380)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000003c0), 0x0, 0xfffffffffffffffb)
keyctl$get_keyring_id(0x0, r3, 0xd1b7)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000000))
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
r4 = fcntl$getown(r1, 0x9)
fcntl$setownex(r2, 0xf, &(0x7f00000001c0)={0x2, r4})

03:36:20 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000"], 0x87)

03:36:20 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x40, 0x0)
setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000000100)=0x5, 0x4)
open(&(0x7f0000000140)='./file0\x00', 0x40280, 0xa0)
pipe2(&(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x4800)
write$FUSE_OPEN(r2, &(0x7f0000000040)={0x20, 0x0, 0x1, {0x0, 0x4}}, 0x20)

03:36:20 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:36:20 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write$binfmt_elf64(r0, &(0x7f0000000140)={{0x7f, 0x45, 0x4c, 0x46, 0x1728, 0x9, 0x5, 0x5, 0x5, 0x0, 0x6, 0xfffffffffffffff8, 0x5c, 0x40, 0x174, 0x1, 0x400, 0x38, 0x1, 0x2, 0x2, 0x3a}, [{0x70000005, 0x8000, 0x5, 0xf6cb, 0x4, 0xe8, 0x5, 0x6}], "77dd68f073fff5f9fda1f55c0cf8788ee5d54224b94b68adeb8f29dc66cc300c9d64f97a6500c5dea704c261fbc5d75ab6d975c35e8b5de45de9da17b821025b6c29cbfa0d3209b1e05ce36abddc144a927a4132cc1cb61cce437deb017315a2216345b793c51e5a94d12daf8a5adfa9e1d84940997c5a4a8fc07bb08380cddbc2c4355df6907ad41d35f9d814dd6596eb2b06883520beb4c476ab12f752703d6067d944ab916693a30190bf9a311772cc5cec2f00c3e8d7564729915ad5c1fbe5ffc099ce5dd72fee"}, 0x141)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000040)=0x200, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:20 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:20 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={<r2=>0x0})
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000400)={0x68, 0x0, &(0x7f0000000380)=[@dead_binder_done={0x40086310, 0x2}, @enter_looper, @transaction_sg={0x40486311, {{0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000080)=[@flat={0x77682a85, 0x0, r2, 0x1}], &(0x7f00000000c0)=[0x0]}}}, @dead_binder_done], 0x48, 0x0, &(0x7f0000000480)="1391124b26f3575428d4e0d0aa6b8518570ea9dd48cfa1379173c18a7f873a3489ff908d624cd37d42e5a6421288345b6d764ef35c1b6e1646a1c363e8f84fc25630c1cb8333480b"})
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)="76d0ca22e12de601d5e004de11d5d325d9d34d99f889ab1c95122f642c9252eb1810841be04decd03a29b100000000fb214a24347605013cc7d5ededd103af67539434ef46e301340a9ff30ddcddc26e5eae58d931388cbf2c764874fc6cfcc11fae62e199f1f049553d8b1d021db2d39f550446ec721f360ae5df787f9d122560f6b9948416e0841390a1f619b15684e58dbab27fa327889073acc8cd480ab0a0d30e6cab75f2d4317b72b545d48a1888073a94b3b6c038bd51603c892aac2c8b35f6e522f30ae5ede07bc5de626f46e9bc13610e053fa83fbbb28693c944d2dd919e889c8d20348531760c4458970b2aa044bef5c9f4fb13f804213927f22168bfb6a626b62724da565702de30b6c9d97a28f175b30bfedae1c1405f54f9c2369d6b9790eb954a192d74a7f698d3ced8f18b0de09d9d31722a11716c231a7942bce8c3af1eb7d83d4e21283cd1e18d909149a0a9a472a69925539d8c0a9883723ff7792ecad08fbec504afcd5e9fd0055f34e9cf8abb2347c4d773924bad0736bd3731d744bb8a8ac234a03a63bd727a405a4bd3df301c7a2e3026a7556c3570fe2b3f9b2a75f04366838a", 0x0, 0x0)
ioctl$SG_NEXT_CMD_LEN(r3, 0x2283, &(0x7f0000000040)=0xdf)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006326400000000000000000eadcf300000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

[  412.556796] binder: 11457:11459 unknown command 1522557696
[  412.565907] binder: 11457:11459 ioctl c0306201 20000440 returned -22
[  412.575963] device lo left promiscuous mode
[  412.577988] binder_alloc: binder_alloc_mmap_handler: 11457 20001000-20004000 already mapped failed -16
03:36:20 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:20 executing program 7:
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/backup_only\x00', 0x2, 0x0)
ioctl$RTC_UIE_OFF(r0, 0x7004)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20010, r0, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
openat(r0, &(0x7f0000000080)='./file0\x00', 0x80000, 0x40)
ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2)
ioctl(r2, 0x73f, &(0x7f0000000480)="59f369d9166dbc575263ca806f296f75946c8f0a087d4849b7392f28111ad9f8bc5ea1d91c8e7b585f983863bf9ee032dcfbec5e4a8d57893557cddf0dc5e569bb6fa0a800db83b8235ffcb8f87b73306528f336344bb45d0d5665a1cc9e55a322a4c2eb8f4bc9929dd8adb48d3fa144e653e6fd501a21cadd36dc09ad581d2ec17f6d6e7bb560abea1e2b213ecba00b01ee759fc7083048e762391590f431b970c4c096c95b64dc99e6096e045f121b155a690e300699a6a46b882e762e5bf304f939d0e595dc3bbe6e8470410822ddc244bd6929c6ecbd5a3b2c7e0e33a0145643b410b3ffa94124892a2a079155a9b0e32b0491d5a403cbcd123a0fec5c516a29d434db1a78c86559695819563a40c367d3077647e0e769c3cfee9be86c2c5d571badc1e0ba966bdf75010a9fab6a415c08454cc228a0abfd2542fc431120295629b72fda4b1c8ee5242b7fddcb459ea53e2b642323479096f24866ffb23167960038f2bed67692ae90c95f3f1996fd6d78a11bacc6f7c2c4800320c3af9f6f25ef1172405d874e670517d114f6dafbcb2a44ab4766a0719831d41cef93b6d9d82c08bea000a629759d3674196580f676c751addb551501bd009d477bfd5b5071d775c34f6eddae7d9d6d965f1a5049e96cb59bddc83b2e225befd3c3df6426d5d6cfb44fb94411830f0d4eb99f252dad515deefcce4a78b6fcecb4861890de39e2bb91f32277800db2b87c227591acd89f22283836e7deacfa2dbc014e8a02199895d2fa7a29f37f134ce8898887bc92b4c35524d48df8bb6cde653f9c83976b0c1da9f039fbf0b06fa507bdc2a5aa4404cf8800a6d0b88082c38dcd152539077f5499217b75aa5a176171d674479df7a008b53a088eb0c2d6a2e33837d5f49e47943097052690fa283fa201f68c9a5c83399ec9ca93df1b4713ddb77eb2499c742b1f2eff89006e512a508f20f8dfcd0e605372fd0efc8f166ad5cabc8725b861579d776df2edae718edce8c0e3ae366e288fe41a4b148b874ac5b48edcd0b658e76bfb88b3595a4399bb74cee1529b759dd8e598a0a74b98a002807210eaed441bb853d867308225014bc7a12dea474812c22b99c7e3083b29e6d815798ae6a885b70574f455631c3c35dedf11cec083c15bbfb7d56520fd2280899edecb70a368c3fe65f91722e6736fbbe84c66c26f9df24ef304c902eb7e92640e2cce7e79e0ea00c80c2a22d99c19c70ed98c0d0ef69c7909e5397949b24add02d19fb9a562e970d1736e25c3e1418fa27832fce393565838b123b53d2482b3221fe3c413b213e9e559790347c6f1a8fc1c5887c8d84f43768f20f3b6b72902c1888fdf05011f2ae990bc8d5876a9ee60b9f49d5a7d03636e30b66db192518c872f099d47e069ed6c68b21aa2595fbc8e8aa8fafb032fd29cfa4b8b2e60884e2aa8b97ea3333dd88cc11545810db967006986b13ff2f60d68da24311f6c7d4922f19fc2bc0b62300848448076d28901295e63f79c44628040a316b053f0ff144205e7a58f38111503c958742d4bdb1fafcb8c1dce92649149deaf130e9af9884bc786487e019115c574117bba68a007f6ba046ea1a11820e8a7b8244f959e685110f324a2e1f016a3fc644cc6323cd265be64537dfa86bdfeca2fda032820dd123ae33e198d838f542861925b45e24458cc64e7949bb3baba9edafcc6d49407ce3524d7dc61f9cbb820ea3755288d9e495f7f2fe8ba3c27b99952932f3caee0c454583b318b15098afe2adfac53944818228b8dd7e5a934814b84fa2d8010dd6ed7261c261a312e5c9c689cb57ff0a9470a75c8dff7a53be688502caf57d776ef2622e809dc696400558996bffb543d2cd1280eea4cef7c7b1dd3ccca3c8717def915bbdf0740eb339afd5a4a0e64cef694a15c42681da9b6aa14f11530cc4e2f99b9d03887e53df97a60d4155a619bb6350ece5a412c2adda97d4da4a141b68080a1adf359a78c153d0bd56085747d7920d176e6fea0a8ec081c616e46bbdab1312f08bc40f9ebb615ec154e73e4092a78fd53dc0cdb77941d2a4d11edaaf070274bdec77e9c7cc6e4c0b398df9ca2e05a4233cd78db02b0f19a34ea9f058f70e8182491d12b0e9b27be167471cb5159f7513ccf88e34dbaadb468042e07b668fbe69f40ebcf8f8dfa4ecbc01e290dfac65feff4755da8be7c8f1f54df81b131d6ea7ac9fe228fcca316a8a259463830e3c37c660c40d794b7c33b281187db6c366f70ee54395ce42e3776252af816a186f410be0ed9dce57f262cbad25d8f76af13458f8040aa6bccef96ffce98ccb7b64bf8c22f944d171eab7f4092a3848d55f8cbd9bd7235722129f3202da36b15e3783df256d9e7302cee5ec66099b68360c561aff814a471457d4aad4a656aa63d4efe9a20d242c96629fbb048fb2fd0b1c17b546d22a1eca698e5b5b1f5a0ab7596ec7fe09e84247e0810483648edb3d37fe514be8f7efe143d616626726b4ed43c961f188f29d8cb02c23e944fdd8b3d366bc9531838761c4010ade6736082cce37a3af3a5892e67f615a05525f7431e9e3c50ee4016c9a9b4e447e17dcb10b106d2350626db281f3646e5513a0a8d881ff5077b15cad6bf96708ebc59a0fef8c346569888bba7692864f6360767eec8a21a2bf03d36784d1cdbabab7ca49aec78f23d35bb2733bbf99fedd74587f3da9e54d52b9395a3a0b46a7b95d0d055b564e217c939ee5246eef430a84581642a9e574532410d822d86386d2b2f904b25bc08c9cda2ca4e8536927a799995045f0d8685805ecbbc2a3a3e5612e3b165de7f1cbd8198ff4a69f33d87f76875214c238945266db4c22f546995bcb4c10e844a66e4b4667b871b76aca72101239c7eddf8d61804463fc5e05035229d795588901277a5cbac55a06951fe57d6e388ceababf9d7706b6eee1b8ff53cf7065186526cb52bf1f00863dd9e844d71edb429d698a46015c202e735abb7b0a29302dec4ee7eebc9d0788b289a9e9672c19ce4970331252815b5f635e9831f43012e4eb797908998fcb2086d70bb2d5cad7b846642f15fc488ca49649cf8330f756bb65605611503284c67dcdd7b03713d06c525533751251e1c89bc131e29bee607593b5d661f0e268da859410bcabaa63f5e6b4c8809770d973e1c35611246504b4f58d0b61ace76ea67a97bd0fa9670075daa59d92fb60b21745d146b2a627e59998a15df1f0e9de0b08e1aca2f733822d3e5f95ff858d8c0056523f70d8ca760eb7d7819a95bceac68c1919831526e2a1704e4809a46b752ee861f03f3f781591eba2a8b985c94ea77ff64c53d2aabd9d16b662a44aaf00545c543c5f7b9c0c2f0c0f5b0338aed8d05aa743f068d2ed0384a8e4296233fecb99bd58012f6f58e7f5fd2f6d7af567dab0cd53fa8178620cc8a0786d19f61a567edb45239f86d5f81579c48183aeda7018f49ed323e9dfe8bac5e8077e0dae8e3d76a99d4a36f35c90b7bebbf0ccd8745eeb3492691adaeaa74664da4558774a98405ed876f5592b851a8814430aac990de090ca79a392aeaa42dfb4aaf72169fd22510a0cbec256b40c123121e09520f688dbcb0acc7a9f8f1d047202d90cb66e8fb45f9bfbf5ddedcaec601c2a75df798df9d90a390066e7202f8777517f8e7a617a37ce3b74daa33c26519999121462c0d166c6919ce7da70051f94c1ec43ee095217afe382f24374f1b91c0310b7bf26c65c61a553fa0e9970eb479c9b36e55e097dd80e3b7604bc2330d4379e0550b992d57f67ec3392a59aa67431d45983a011137ae690c72383f3277c1a7c582057202c427ac973519fbfd5dda3dd5dcac46fa90c6407cc37a2a4a4a475965107e76010c963f54cdcd3da114d5c2c4bc2f71d38d27bffb664205f0e5a00890e11a3f324935ead9f9fa430746ccfbf32e2cd63d1c1c05f081ef0543ff72fcd9f27c4d2882ded2b14bbe771348313b930e2387b77b97b420e45558ef5647ba3925a8f4c6009fff1ec82a64b83d0f59e67a2dfaf2e4e1eee05e3e281cc6ed5f7fa26377123aeceb14f7030cf11c25ba057e5b973878eac2b25992872060972cce5359abc494b2200c151d974774698137709fe97af26d7a40bc1803406982263174ffee11e94cabfabc45cc5c7ac4966767740e8d25d94f9c7e64b6f106fc2e9445fc003e3ce2883a78d96384dc67c7ed8ac6cb69bb84e99d582bc92e874b67427f51ec4d87bf9678c651bcc16e89331201e6fe88f70224bfb39fc314506b526dd0926f19ea14488b866dc8d68f47466f7e966c792ab7946b3095425b423374fc83771a097cb91b919de0707d23d95bdfb15d1622ccf1139cbdc7aa361f16b88181c26dad4829465e954ba2fc45ddbb64bd2a957b355532b76f71aca9e9e7d9eac58339a18d1e0cd8848c3a72cc3804fe51c77418dd27115755b9271e0f2577ca6e0c1748e43f93baa429daa84ef16293b74f9ea484530fffe8c3e4980a1cc779cf503d791d8274e8b2bf117bb5817a0dd78ca36af5a099552d7eabe5f50ce5dc93748b7bf63ea8cd447eb6b03e24c06c75da1d7b3d7411ac72c8f5f5440e7242e0f72c918311c48a87ef3a7da850fed6985fe8c9cd6b76f7c48885c905e76a891d9b14567e76c55ee90d492b586eb1eba8d2a4a6c85321bbc4c5a04097370cc875f09830a0d74fca842c92a035800951a8c971aacfbc35de0bc82bbac47c3f6c5d275f23b90b45e069fb68bf0be1da75b0f295fad50724aca19a3b889c4d6d9d7efd5ddfb11f2e2bb1b278f276e4db07169bc156be930e8dc88acf39e5c912f77b9feff6f6afd95d16cccc6f504ab985edf5c393df9860780ffc1930ef082b873cac159e448471d82a4d7c21a8640341a6ca42215a0c62d327dadcd76915011c714f9ede56e0b590593a70c80aaf1264382bad0466b8f10260cc9f16476af314c6209eb22d5e8026ca090f6a5ec645e2e2ca711efffe5180a28a30a300ce8272d58771d1157966333d90e4008e9b4ed1fe2c283930ce1244c2a0fe50278602f6e8a910e088518e999528497da75f25968f405a54b58974a7f54e5a1aeb9dc288a29417f96a6635fb2fc78a9944f88f40535cb05625decaf9802d0fb82b5e4fab08200c7f0f1e93ab196970cbcfe3bceb33ea768797468b5fc1f40ebb26ebe15e7f30a53d0fd924ac6e3807f21340a9c35592c2bbe7094c9624c103ec8609cc3a475aa30bbc25f7f5c4b1f95e0dab6de8b2d1274bf4773ce149d6f76509814ec8c5e06bd03f67e5e75f614da8106e1453e4e5677c0568370b4a805980ee817a807050739144f972962c3a74ed08a9feab6364c523063d5e69eaaea21a86263f15331f438fa074e7043fb306e6257adc5afe79f16772afce94b1e975d90c7378e24689a71e78d89b57c379513c74e7f278d005244e559afd00628b1d8e8c1aa1058dbbd2de657914fc972fcc026ae9735be88a5ee565e05ef983b5908f81ae82acdc67b32fcceb3cb406ca586826dc49f87dacc6d5d330d95870baaa0803dbab31dccc1b165fe610108b5494443b2f3c8928f0db75fa44b72f7499f3cc6f53ad07ebb4b57bc72deab5918c800fce617f7c2ddd557813e1d2988fff3a95ac7b48ebe60fb1d96b23a3ee94c2c86d4ae5886564873629634ef4ad712e9b327223658ff3d4db5d2bdfc54dd716f0a9cba707677633e35329a4728292456b64f633313a5779030aa7781588b666d04b7e8a67e5df75419e9b03470fdf1b8b6ffb27974da99c574847274028ce")
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000040))

[  412.578095] binder: BINDER_SET_CONTEXT_MGR already set
[  412.578102] binder: 11457:11469 ioctl 40046207 0 returned -16
[  412.591617] binder: 11458:11467 ioctl c0306201 20000440 returned -14
03:36:20 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  412.606623] binder_alloc: 11470: binder_alloc_buf failed to map page at 20001000 in userspace
[  412.606662] binder: 11470:11474 transaction failed 29201/-12, size 0-0 line 3136
[  412.607591] binder: BINDER_SET_CONTEXT_MGR already set
[  412.607600] binder: 11470:11474 ioctl 40046207 0 returned -16
[  412.607643] binder_alloc: 11470: binder_alloc_buf, no vma
[  412.607659] binder: 11470:11475 transaction failed 29189/-3, size 0-0 line 3136
[  412.608004] binder: undelivered TRANSACTION_ERROR: 29189
[  412.608080] binder: undelivered TRANSACTION_ERROR: 29201
[  412.633413] binder: 11477:11483 ioctl c0306201 20000440 returned -14
[  412.645098] binder: 11482:11484 BC_DEAD_BINDER_DONE 0000000000000002 not found
[  412.645213] binder: 11482:11484 got transaction to invalid handle
[  412.645222] binder: 11482:11484 transaction failed 29201/-22, size 24-8 line 3013
[  412.648759] binder: 11482:11484 unknown command 1076257536
[  412.648768] binder: 11482:11484 ioctl c0306201 20000440 returned -22
[  412.649294] binder: 11482:11484 BC_DEAD_BINDER_DONE 0000000000000002 not found
[  412.649303] binder: 11482:11484 got transaction to invalid handle
[  412.649310] binder: 11482:11484 transaction failed 29201/-22, size 24-8 line 3013
[  412.650002] binder: BINDER_SET_CONTEXT_MGR already set
[  412.650010] binder: 11482:11487 ioctl 40046207 0 returned -16
[  412.671336] binder: 11488:11489 ioctl c0306201 20000440 returned -14
[  412.706638] binder: 11494:11498 ioctl 54a2 0 returned -22
[  412.707070] binder: 11494:11498 ioctl 73f 20000480 returned -22
[  412.707158] binder_alloc: 11494: binder_alloc_buf, no vma
[  412.707177] binder: 11494:11498 transaction failed 29189/-3, size 0-0 line 3136
[  412.711751] binder: 11499:11501 ioctl c0306201 20000440 returned -14
[  412.721717] binder: BINDER_SET_CONTEXT_MGR already set
[  412.721726] binder: 11494:11502 ioctl 40046207 0 returned -16
[  412.721893] binder: 11494:11502 ioctl 54a2 0 returned -22
[  412.721979] binder: 11494:11498 ioctl 73f 20000480 returned -22
[  412.722020] binder_alloc: 11494: binder_alloc_buf, no vma
[  412.722036] binder: 11494:11502 transaction failed 29189/-3, size 0-0 line 3136
[  412.722441] binder: undelivered TRANSACTION_ERROR: 29189
[  412.722485] binder: undelivered TRANSACTION_ERROR: 29189
[  413.012946] device lo left promiscuous mode
[  413.020621] device lo entered promiscuous mode
[  413.030728] device lo left promiscuous mode
[  413.081543] device lo entered promiscuous mode
03:36:21 executing program 1:
r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff)
write$P9_RREADLINK(r0, &(0x7f0000000000)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})

03:36:21 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a", 0xb)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:21 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fab687c7d3ccd1ed5b49e25a5b745ecc139c8968b51e2ad08080d904a0e3fedf2fff55051a7fee29d232a28e8d4e2661ca6f80ba38516728713b723620d1a0d48e065ee66e7fe2feb7de1e3fea45dc2f40e6f6ff3337c5fe9300649c0bda5992276be2a145ab6d1e0c879d395c6496a68ceb02ffca097968677cd65d97481ff68364e2a37eee582c44089609c4450287fb63e67920ae731be6bb22b590c3677875ea0e", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

03:36:21 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x10000000003, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000000))
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
r2 = userfaultfd(0x80000)
ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000fff000/0x1000)=nil, 0x1000})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:21 executing program 4:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/autofs\x00', 0x200, 0x0)
ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0xfffffffffffffffc, 0x1, "0fac895cc459982d99764538cb43ac533b0b9da42670bd4976d90ee17e6d77c8f82f25dd0df52b43ec336c6f82542a6be8f84444b7c42d5cd1ebd2a712f3c849", "9cb130834eea16f3f55e08726d9aa07376b66d8675d52ae643c410f6a2f88f40", [0x2, 0xff]})
open(&(0x7f0000000140)='./file0\x00', 0x400, 0x40)
r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
r3 = add_key(&(0x7f0000000340)='dns_resolver\x00', &(0x7f0000000380)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000003c0), 0x0, 0xfffffffffffffffb)
keyctl$get_keyring_id(0x0, r3, 0xd1b7)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000000))
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
r4 = fcntl$getown(r1, 0x9)
fcntl$setownex(r2, 0xf, &(0x7f00000001c0)={0x2, r4})

03:36:21 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:21 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = signalfd4(r1, &(0x7f00000002c0)={0x80}, 0x8, 0x80800)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
pipe2(&(0x7f0000000200)={<r4=>0xffffffffffffffff}, 0x80000)
ioctl$EVIOCSCLOCKID(r4, 0x400445a0, &(0x7f0000000280)=0x6)
r5 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680)='/dev/hwrng\x00', 0x0, 0x0)
ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x40082406, &(0x7f0000000180)='/dev/loop#\x00')
open(&(0x7f0000000300)='./file0\x00', 0x2, 0x2)
sendmsg$nl_route(r5, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="13001900879a975635fd34cb00dc0021950008001b000045ad033d47296b02485219c179bd9f2fb4dd26cfc64e492a995ea5741f318b04a7523ff4b4454c94"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
write$FUSE_BMAP(r6, &(0x7f0000000400)={0x18, 0x0, 0x7, {0x100000001}}, 0x18)
r8 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000000440)={<r9=>0x0, @loopback, @rand_addr}, &(0x7f0000000480)=0xc)
sendmsg$nl_route(r5, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)=@setneightbl={0x68, 0x43, 0x0, 0x70bd2b, 0x25dfdbfd, {0x2}, [@NDTA_GC_INTERVAL={0xc, 0x8, 0x5}, @NDTA_NAME={0xc, 0x1, ')ppp1\x00'}, @NDTA_GC_INTERVAL={0xc, 0x8, 0x2}, @NDTA_PARMS={0x30, 0x6, [@NDTPA_IFINDEX={0x8, 0x1, r9}, @NDTPA_BASE_REACHABLE_TIME={0xc, 0x4, 0x4}, @NDTPA_LOCKTIME={0xc, 0xf, 0x101}, @NDTPA_GC_STALETIME={0xc, 0x6, 0x5}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x4000810}, 0x85)
ioctl$LOOP_SET_FD(r0, 0x4c00, r8)
ioctl$LOOP_CHANGE_FD(r6, 0x4c06, r2)

[  413.187033] binder_alloc: 11515: binder_alloc_buf failed to map page at 20001000 in userspace
[  413.194959] device lo entered promiscuous mode
[  413.205617] device lo left promiscuous mode
[  413.209863] binder: 11513:11516 ioctl c0306201 20000440 returned -14
[  413.230763] binder: 11515:11518 transaction failed 29201/-12, size 0-0 line 3136
[  413.251523] binder_alloc: binder_alloc_mmap_handler: 11515 20001000-20004000 already mapped failed -16
[  413.261697] binder: BINDER_SET_CONTEXT_MGR already set
[  413.269485] binder: 11515:11525 ioctl 40046207 0 returned -16
[  413.276596] binder: undelivered TRANSACTION_ERROR: 29201
03:36:21 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000"], 0x87)

03:36:21 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:21 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
open(&(0x7f0000000000)='./file0\x00', 0x100, 0x80)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:21 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
bind(r0, &(0x7f0000000100)=@in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x10}}, 0x80)
sendto(r0, &(0x7f0000000000)="311d1e57f1f5dcba138d2804401390811d236968972233508ac4e1d84ddb0052d1cd489bbeb548b789b2b43e4609ecd4d294c32530abe6cc", 0x38, 0x40000, &(0x7f0000000040)=@ethernet={0x306, @remote}, 0x80)

03:36:21 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0xa0002, 0x0)
getsockopt$EBT_SO_GET_INIT_ENTRIES(r2, 0x0, 0x83, &(0x7f0000000140)={'filter\x00', 0x0, 0x1, 0x37, [], 0x1, &(0x7f0000000040)=[{}], &(0x7f0000000080)=""/55}, &(0x7f00000000c0)=0x78)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000f1ff000000000000000000000000000000000000000000000000595f00000000000000000000000000871b0a1d0000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

[  413.348089] device lo entered promiscuous mode
[  413.353994] device lo left promiscuous mode
[  413.377250] device lo entered promiscuous mode
03:36:21 executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:21 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  413.386866] binder_alloc: 11539: binder_alloc_buf, no vma
[  413.386885] binder: 11539:11541 transaction failed 29189/-3, size 0-0 line 3136
[  413.387421] binder: BINDER_SET_CONTEXT_MGR already set
03:36:21 executing program 7:
r0 = syz_open_dev$usbmon(&(0x7f0000000380)='/dev/usbmon#\x00', 0x200, 0x6102)
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1f, &(0x7f0000002480)={@loopback, <r1=>0x0}, &(0x7f00000024c0)=0x14)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000002500)={'veth0_to_bridge\x00', r1})
syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000000500)={{0x9, 0x2}, {0xe4ac, 0x800000002}, 0xfffffffffffffffa, 0x3, 0x4})
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xfffffffffffffedc, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYRESOCT=r0], 0x0, 0x0, &(0x7f00000003c0)})
readv(r2, &(0x7f0000000480)=[{&(0x7f0000000140)=""/146, 0x92}, {&(0x7f0000000200)=""/162, 0xa2}, {&(0x7f0000000000)=""/70, 0x46}, {&(0x7f00000002c0)=""/116, 0x74}, {&(0x7f00000003c0)=""/106, 0x6a}, {&(0x7f0000000340)=""/33, 0x21}], 0x6)

[  413.387430] binder: 11539:11542 ioctl 40046207 0 returned -16
[  413.387804] binder: undelivered TRANSACTION_ERROR: 29189
[  413.415899] binder: 11537:11538 ioctl c0306201 20000440 returned -14
[  413.451181] binder: 11546:11552 got transaction to invalid handle
03:36:21 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:21 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f79", 0x6)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  413.451190] binder: 11546:11552 transaction failed 29201/-22, size 0-31929248710656 line 3013
[  413.461001] binder_alloc: binder_alloc_mmap_handler: 11546 20001000-20004000 already mapped failed -16
[  413.461244] binder: BINDER_SET_CONTEXT_MGR already set
[  413.461253] binder: 11546:11557 ioctl 40046207 0 returned -16
03:36:21 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0)
setsockopt$inet6_opts(r2, 0x29, 0x3f, &(0x7f0000000140)=@srh={0x5e, 0x6, 0x4, 0x3, 0x800, 0x0, 0x27, [@local, @mcast1, @loopback]}, 0x38)
setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x484, &(0x7f0000000040)={0x3a, @local, 0x4e22, 0x4, 'lblcr\x00', 0x12, 0x1, 0xb}, 0x2c)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x101000, 0x0)
ioctl$KDGKBENT(r2, 0x4b46, &(0x7f0000000080)={0x17f, 0x80000000, 0x88fb})

03:36:21 executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

[  413.461334] binder: 11546:11552 got transaction to invalid handle
[  413.461343] binder: 11546:11552 transaction failed 29201/-22, size 0-31929248710656 line 3013
[  413.461439] binder: undelivered TRANSACTION_ERROR: 29201
[  413.461658] binder: undelivered TRANSACTION_ERROR: 29201
[  413.468528] binder: 11555:11558 ioctl c0306201 20000440 returned -14
[  413.512590] binder: 11563:11566 ioctl c0306201 20000440 returned -14
[  413.533963] binder: BINDER_SET_CONTEXT_MGR already set
[  413.533974] binder: 11562:11567 ioctl 40046207 0 returned -16
[  413.576824] binder_alloc: 11574: binder_alloc_buf failed to map page at 20001000 in userspace
[  413.576854] binder: 11574:11575 transaction failed 29201/-12, size 0-0 line 3136
[  413.583945] binder_alloc: binder_alloc_mmap_handler: 11574 20001000-20004000 already mapped failed -16
[  413.584196] binder: BINDER_SET_CONTEXT_MGR already set
[  413.584204] binder: 11574:11575 ioctl 40046207 0 returned -16
[  413.584244] binder_alloc: 11574: binder_alloc_buf, no vma
[  413.584259] binder: 11574:11576 transaction failed 29189/-3, size 0-0 line 3136
[  413.584684] binder: undelivered TRANSACTION_ERROR: 29189
[  413.584752] binder: undelivered TRANSACTION_ERROR: 29201
[  413.595266] binder: 11568:11569 ioctl c0306201 20000440 returned -14
[  413.690230] device lo left promiscuous mode
03:36:21 executing program 5:
r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1000000000000002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x1, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={"6c6f0040000000000100", 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0x100})
ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0)
pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000000240)="9c72ecc2e37d53a4e588ccbda560fc5def94e4839783e702f621251c376af139b92d5b863744de52fc51df853577664eb2a7ed127c6dd402a2ed52f6d39dc504c74e49b983f55effbd0f376c8c7e4a63710a7ca9265d5cfed99f8903c127cf0789f0f2a0892c50e06766677b791517", 0x6f}], 0x1, 0x4)
ioctl$EVIOCGBITKEY(0xffffffffffffffff, 0x80404521, &(0x7f00000001c0)=""/121)
shutdown(0xffffffffffffffff, 0x7fffffffffffd)
r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)

03:36:21 executing program 7:
syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x2)
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r2 = dup2(r1, r1)
getsockname$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @local}, &(0x7f0000000040)=0x1c)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000101c093000000000000000000000000100000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$RTC_EPOCH_READ(r2, 0x8008700d, &(0x7f0000000080))
ioctl$TCSETA(r2, 0x5406, &(0x7f00000000c0)={0x101, 0x1e, 0x7f, 0x0, 0x0, 0x9, 0x0, 0x5, 0x7})

[  413.737911] device lo left promiscuous mode
[  413.762839] device lo entered promiscuous mode
03:36:21 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0))
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

[  413.783943] binder: 11579:11583 got transaction to context manager from process owning it
[  413.800474] binder: 11579:11583 transaction failed 29201/-22, size 0-0 line 3004
[  413.819101] binder: 11579:11583 ioctl 8008700d 20000080 returned -22
[  413.833203] binder: 11579:11583 ioctl 5406 200000c0 returned -22
[  413.853220] binder: BINDER_SET_CONTEXT_MGR already set
[  413.858865] binder: 11579:11583 ioctl 40046207 0 returned -16
[  413.864302] binder_alloc: 11579: binder_alloc_buf, no vma
[  413.864326] binder: 11579:11588 transaction failed 29189/-3, size 0-0 line 3136
[  413.864416] binder: 11579:11587 ioctl 8008700d 20000080 returned -22
[  413.864447] binder: 11579:11588 ioctl 5406 200000c0 returned -22
[  413.864884] binder: undelivered TRANSACTION_ERROR: 29201
[  413.897266] binder: undelivered TRANSACTION_ERROR: 29189
03:36:21 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x200, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000200)={@local, 0x100000000, 0x2, 0x3, 0x0, 0xffffffff, 0x800, 0x3}, 0x20)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
vmsplice(r1, &(0x7f0000000400)=[{&(0x7f0000000280)="7854cc9955197164538ef8cec598d0fb6031375ca59a4df4084c42ea2ff1ddf46d0a4aafb03fc72fcf373a13a57a318836a65d07fdafc174622ee96ec67f0a1a659e80af4e7ef86ae6705f92943ac12c441f4bcd19733cceaadfe72c1d51eb178b80c3e797adb5626cfab0192462699a150da0c9cc98eaab3fca7692fc4c02746528b7dd273855b0530ee3ed19b59f1e5658077db935608d3ab0e85d50138f202e2e4aa9ed99d0dc84fbd982fa1079b2bff28b1c73d6693c1967e174e64c11c20e38ed7058aeb464", 0xc8}, {&(0x7f0000000380)}], 0x2, 0x6)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f0000000380)={0x2, 0x9, 0x7, 0x1, 0x4})
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:36:22 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000"], 0x87)

03:36:22 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f79", 0x6)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:22 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x4000, 0x0)
connect$l2tp(r1, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @local}, 0x2, 0x4, 0x0, 0x3}}, 0x2e)

03:36:22 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x80000, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x88200232}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000001a0004002cbd7000fddb03000000020000"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4c040)
bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:22 executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:22 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
utime(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x80, 0x3})

[  414.214555] device lo entered promiscuous mode
03:36:22 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000271c322100000000f1ff0000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0xffffffffffffffa3, 0x0, &(0x7f00000003c0)})
syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2)

03:36:22 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="03000000000002000800130000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

[  414.244683] binder: 11601:11608 ioctl c0306201 20000440 returned -14
[  414.251272] device lo left promiscuous mode
[  414.251699] binder: BINDER_SET_CONTEXT_MGR already set
03:36:22 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@ipv4={[], [], @dev}, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{@in=@remote}, 0x0, @in=@remote}}, &(0x7f0000000280)=0xe8)
r3 = getegid()
chown(&(0x7f0000000140)='./file0\x00', r2, r3)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
r4 = memfd_create(&(0x7f0000000040)="9a2140766d6e657430766d6e6574312c2800", 0x1)
getpeername$inet6(r4, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1c)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
mkdir(&(0x7f0000000000)='./file0\x00', 0xb8)

03:36:22 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  414.251709] binder: 11604:11607 ioctl 40046207 0 returned -16
[  414.253885] device lo entered promiscuous mode
[  414.264380] device lo left promiscuous mode
[  414.288396] binder_alloc: 11613: binder_alloc_buf failed to map page at 20001000 in userspace
03:36:22 executing program 7:
syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x20211, r0, 0x0)
r1 = dup(r0)
ioctl$TUNSETPERSIST(r1, 0x400454cb, 0x1)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

[  414.288427] binder: 11613:11618 transaction failed 29201/-12, size 0-0 line 3136
[  414.301824] binder_alloc: binder_alloc_mmap_handler: 11613 20001000-20004000 already mapped failed -16
[  414.302883] binder: BINDER_SET_CONTEXT_MGR already set
[  414.302891] binder: 11613:11620 ioctl 40046207 0 returned -16
[  414.302985] binder_alloc: 11613: binder_alloc_buf, no vma
[  414.303002] binder: 11613:11618 transaction failed 29189/-3, size 0-0 line 3136
[  414.350487] binder_alloc: 11624: binder_alloc_buf failed to map page at 20001000 in userspace
[  414.355944] binder: 11624:11626 transaction failed 29201/-12, size 0-0 line 3136
[  414.374529] binder: BINDER_SET_CONTEXT_MGR already set
[  414.374538] binder: 11624:11626 ioctl 40046207 0 returned -16
03:36:22 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000d56aeae61d5308580000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

03:36:22 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x28040, 0x0)
ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000040))
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:22 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
fcntl$dupfd(r1, 0x406, r0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xfffffffffffffd2c, 0x0, &(0x7f0000000000)=[@acquire={0x40046305, 0x1}], 0xfffffffffffffd14, 0x0, &(0x7f00000000c0)="2696d194aa8dff26145214fbe8eb4cde21dce5"})

[  414.374541] binder_alloc: 11624: binder_alloc_buf, no vma
[  414.374559] binder: 11624:11628 transaction failed 29189/-3, size 0-0 line 3136
[  414.374963] binder: undelivered TRANSACTION_ERROR: 29189
[  414.375027] binder: undelivered TRANSACTION_ERROR: 29201
[  414.406089] binder: BINDER_SET_CONTEXT_MGR already set
[  414.406098] binder: 11631:11633 ioctl 40046207 0 returned -16
[  414.460068] binder: 11636:11638 ioctl 400454cb 1 returned -22
[  414.482448] binder_alloc: binder_alloc_mmap_handler: 11636 20004000-20008000 already mapped failed -16
[  414.482952] binder: 11636:11640 ioctl 400454cb 1 returned -22
[  414.483071] binder: BINDER_SET_CONTEXT_MGR already set
[  414.483079] binder: 11636:11639 ioctl 40046207 0 returned -16
[  414.534293] binder_alloc: 11642: binder_alloc_buf size 378096786920 failed, no address space
[  414.534300] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  414.534327] binder: 11642:11643 transaction failed 29201/-28, size 378096786918-0 line 3136
[  414.537569] binder_alloc: binder_alloc_mmap_handler: 11642 20001000-20004000 already mapped failed -16
[  414.537695] binder: BINDER_SET_CONTEXT_MGR already set
[  414.537702] binder: 11642:11644 ioctl 40046207 0 returned -16
[  414.538284] binder: undelivered TRANSACTION_ERROR: 29201
[  414.538329] device lo left promiscuous mode
[  414.548032] device lo entered promiscuous mode
[  414.565206] device lo left promiscuous mode
[  414.653386] device lo entered promiscuous mode
[  414.660226] device lo left promiscuous mode
[  414.667236] device lo entered promiscuous mode
[  414.671996] device lo left promiscuous mode
[  415.366066] binder: BINDER_SET_CONTEXT_MGR already set
[  415.371407] binder: 11649:11660 ioctl 40046207 0 returned -16
[  415.518947] IPVS: Creating netns size=2536 id=97
[  415.552664] IPVS: Creating netns size=2536 id=98
[  415.816323] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  415.834875] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  415.881698] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  415.900906] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  415.927822] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  415.946384] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  415.995008] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  416.028205] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  416.067042] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  416.089180] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  416.107680] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  416.115629] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  416.123166] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  416.141618] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  416.148566] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  416.160297] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  416.169531] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  416.188131] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  416.208202] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  416.227264] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  417.266527] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  417.321037] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  417.327314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  417.334097] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  417.376982] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  417.431905] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  417.438100] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  417.444776] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:36:26 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0))
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:26 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000140)={'ip6_vti0\x00', 0x101})
ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000040)=<r1=>0x0)
ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000080)=r1)
r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0)
write$P9_RLERROR(r2, &(0x7f0000000000)={0x14, 0x7, 0x2, {0xb, '/dev/loop#\x00'}}, 0x14)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:26 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0xb403})

03:36:26 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f79", 0x6)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:26 executing program 3:
r0 = add_key$keyring(&(0x7f00000003c0)='keyring\x00', &(0x7f0000000480)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffffb)
r1 = request_key(&(0x7f0000000500)='.request_key_auth\x00', &(0x7f0000000540)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000580)='!&vboxnet1posix_acl_accesssecurity@&bdevuser\x00', 0xfffffffffffffffb)
keyctl$reject(0x13, r0, 0x2, 0x9, r1)
r2 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r3 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r4 = request_key(&(0x7f0000000180)='pkcs7_test\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000380)='/dev/net/tun\x00', 0xffffffffffffffff)
r5 = add_key(&(0x7f0000000400)='asymmetric\x00', &(0x7f0000000440)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffff9)
keyctl$reject(0x13, r4, 0x5df8, 0x4, r5)
lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)=@known='trusted.syz\x00')
r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r7 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r8 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/enforce\x00', 0x8000, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(r8, 0x29, 0x23, &(0x7f00000005c0)={{{@in6=@local, @in=@multicast2}}, {{@in6=@local}, 0x0, @in=@remote}}, &(0x7f00000006c0)=0xe8)
r9 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/hwrng\x00', 0x101005, 0x0)
ioctl$EVIOCGPROP(r8, 0x80404509, &(0x7f0000000700)=""/227)
sendmsg$nl_route(r7, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="355314af699908001b0080000002303fc08bf3e94907506bfb6553000000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r2, 0x4c00, r2)
ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3)
accept$inet(r9, &(0x7f0000000800)={0x2, 0x0, @remote}, &(0x7f0000000840)=0x10)

03:36:26 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f00040000000000000000"], 0x8c)

[  418.578404] device lo entered promiscuous mode
[  418.591866] device lo left promiscuous mode
[  418.602155] device lo entered promiscuous mode
[  418.618789] device lo left promiscuous mode
03:36:26 executing program 4:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x200, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000200)={@local, 0x100000000, 0x2, 0x3, 0x0, 0xffffffff, 0x800, 0x3}, 0x20)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
vmsplice(r1, &(0x7f0000000400)=[{&(0x7f0000000280)="7854cc9955197164538ef8cec598d0fb6031375ca59a4df4084c42ea2ff1ddf46d0a4aafb03fc72fcf373a13a57a318836a65d07fdafc174622ee96ec67f0a1a659e80af4e7ef86ae6705f92943ac12c441f4bcd19733cceaadfe72c1d51eb178b80c3e797adb5626cfab0192462699a150da0c9cc98eaab3fca7692fc4c02746528b7dd273855b0530ee3ed19b59f1e5658077db935608d3ab0e85d50138f202e2e4aa9ed99d0dc84fbd982fa1079b2bff28b1c73d6693c1967e174e64c11c20e38ed7058aeb464", 0xc8}, {&(0x7f0000000380)}], 0x2, 0x6)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f0000000380)={0x2, 0x9, 0x7, 0x1, 0x4})
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:36:26 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000000)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$sock_proto_private(r2, 0x89e5, &(0x7f0000000040)="0f461268a6301832a9abf947e468c8e8bb67bbf2c20d34da8bfb96554d5b5f3af3ecff7652199147c8d70eccfeed5a2c7e7c613121ce5eee5fbefcc07a91ff26f5fa4daf6705046f6bb1097955023a23d42cd126eac83ae4b606efe0482b0ab9c04213539ba77b5636f1d4b96d3734e272c83627d10cda6b7ac801d545215d2d325805cd17cb7928a31312")

03:36:26 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0", 0x9)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:26 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
stat(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
r2 = request_key(&(0x7f0000000340)='ceph\x00', &(0x7f0000000300)={0x73, 0x79, 0x7a, 0x2}, &(0x7f00000002c0)='@{\x00', 0xfffffffffffffffc)
keyctl$get_persistent(0x16, r1, r2)
clock_getres(0x3, &(0x7f0000000000))
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
fstat(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, <r3=>0x0})
setuid(r3)

03:36:26 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000000140)='\x00', 0x3)
ioctl$RTC_ALM_READ(r0, 0x80247008, &(0x7f0000000240))
write$P9_RCLUNK(r0, &(0x7f00000001c0)={0x7, 0x79, 0x2}, 0x7)
socketpair(0x4, 0x1, 0x6c787f84, &(0x7f0000000000)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
setsockopt$inet_tcp_int(r1, 0x6, 0x16, &(0x7f0000000040)=0x9, 0x4)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x200})
set_tid_address(&(0x7f0000000080))
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
fstatfs(r2, &(0x7f0000000540)=""/4096)

[  418.622374] binder: 12414:12417 ioctl c0306201 20000440 returned -14
03:36:26 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = accept(0xffffffffffffffff, &(0x7f0000000000)=@un=@abs, &(0x7f0000000080)=0x80)
getsockopt$ARPT_SO_GET_INFO(r2, 0x0, 0x60, &(0x7f0000000140)={'filter\x00'}, &(0x7f00000000c0)=0x44)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00630500000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

03:36:26 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
socket$packet(0x11, 0x3, 0x300)
r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r3)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

[  418.679679] device lo entered promiscuous mode
[  418.683860] binder_alloc: 12433: binder_alloc_buf failed to map page at 20001000 in userspace
03:36:26 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0", 0x9)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:26 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xfffffffffffffffe)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  418.684349] binder: 12433:12439 transaction failed 29201/-12, size 0-0 line 3136
[  418.685857] binder_alloc: binder_alloc_mmap_handler: 12433 20001000-20004000 already mapped failed -16
03:36:26 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0", 0x9)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  418.686063] binder: BINDER_SET_CONTEXT_MGR already set
[  418.686070] binder: 12433:12440 ioctl 40046207 0 returned -16
[  418.686184] binder_alloc: 12433: binder_alloc_buf, no vma
[  418.686200] binder: 12433:12439 transaction failed 29189/-3, size 0-0 line 3136
[  418.686636] binder: undelivered TRANSACTION_ERROR: 29189
[  418.686691] binder: undelivered TRANSACTION_ERROR: 29201
[  418.714279] binder: 12432:12436 ioctl c0306201 20000440 returned -14
[  418.717347] binder: 12443:12445 unknown command 353024
[  418.717355] binder: 12443:12445 ioctl c0306201 20000440 returned -22
[  418.718095] binder_alloc: binder_alloc_mmap_handler: 12443 20001000-20004000 already mapped failed -16
[  418.718186] binder: BINDER_SET_CONTEXT_MGR already set
[  418.718193] binder: 12443:12446 ioctl 40046207 0 returned -16
[  418.771674] binder: 12451:12453 ioctl c0306201 20000440 returned -14
[  418.790323] binder_alloc: binder_alloc_mmap_handler: 12450 20001000-20004000 already mapped failed -16
[  418.790411] binder: BINDER_SET_CONTEXT_MGR already set
[  418.790417] binder: 12450:12458 ioctl 40046207 0 returned -16
[  418.790710] binder: send failed reply for transaction 199 to 12450:12457
[  418.790771] binder: undelivered TRANSACTION_COMPLETE
[  418.790777] binder: undelivered TRANSACTION_ERROR: 29189
03:36:26 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0))
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:26 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:26 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x0, 0x0)
setsockopt$inet6_mtu(r2, 0x29, 0x17, &(0x7f0000000180)=0x5, 0x4)
ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa04, &(0x7f00000000c0)={{&(0x7f0000002000/0x1000)=nil, 0x1000}, 0x1})
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
mmap$binder(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x2000000, 0x10030, r0, 0x0)
poll(&(0x7f0000000140)=[{r1, 0x100}, {r2, 0x401}], 0x2, 0x9)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000005ac43e50000000000000000002fad3c6ddcb485c7ed17718d0000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

03:36:26 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
open(&(0x7f0000000000)='./file0\x00', 0x80000, 0x22)

[  418.822308] binder: 12459:12461 ioctl c0306201 20000440 returned -14
[  418.931984] device lo left promiscuous mode
[  418.956041] device lo entered promiscuous mode
[  418.962648] device lo left promiscuous mode
03:36:26 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pivot_root(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00')
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

[  418.999024] binder_alloc: 12474: binder_alloc_buf size -5967549996559760128 failed, no address space
[  419.012266] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  419.021208] device lo entered promiscuous mode
[  419.030189] device lo left promiscuous mode
[  419.033647] device lo entered promiscuous mode
[  419.036651] device lo left promiscuous mode
[  419.070148] binder: 12475:12483 ioctl c0306201 20000440 returned -14
[  419.118989] binder: 12474:12477 transaction failed 29201/-28, size 984682857728--5967550981242617856 line 3136
[  419.136639] binder_alloc: binder_alloc_mmap_handler: 12474 20001000-20004000 already mapped failed -16
[  419.146553] device lo entered promiscuous mode
[  419.151639] binder: BINDER_SET_CONTEXT_MGR already set
[  419.157232] binder: 12474:12477 ioctl 40046207 0 returned -16
[  419.157243] device lo left promiscuous mode
[  419.168660] binder_alloc: 12474: binder_alloc_buf, no vma
[  419.174288] binder: 12474:12490 transaction failed 29189/-3, size 984682857728--5967550981242617856 line 3136
[  419.232022] device lo entered promiscuous mode
[  419.235281] binder: undelivered TRANSACTION_ERROR: 29189
[  419.243403] device lo left promiscuous mode
[  419.275586] binder: undelivered TRANSACTION_ERROR: 29201
03:36:27 executing program 4:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x200, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000200)={@local, 0x100000000, 0x2, 0x3, 0x0, 0xffffffff, 0x800, 0x3}, 0x20)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
vmsplice(r1, &(0x7f0000000400)=[{&(0x7f0000000280)="7854cc9955197164538ef8cec598d0fb6031375ca59a4df4084c42ea2ff1ddf46d0a4aafb03fc72fcf373a13a57a318836a65d07fdafc174622ee96ec67f0a1a659e80af4e7ef86ae6705f92943ac12c441f4bcd19733cceaadfe72c1d51eb178b80c3e797adb5626cfab0192462699a150da0c9cc98eaab3fca7692fc4c02746528b7dd273855b0530ee3ed19b59f1e5658077db935608d3ab0e85d50138f202e2e4aa9ed99d0dc84fbd982fa1079b2bff28b1c73d6693c1967e174e64c11c20e38ed7058aeb464", 0xc8}, {&(0x7f0000000380)}], 0x2, 0x6)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f0000000380)={0x2, 0x9, 0x7, 0x1, 0x4})
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:36:27 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f00040000000000000000"], 0x8c)

03:36:27 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f00000000c0)={<r1=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x3, 0x0, 0x4, 0x0, 0x10, 0x0, 0x0, 0x48, 0x28, &(0x7f0000000000)=[@fd={0x66642a85, 0x0, 0xffffffffffffffff, 0x0, 0x2}, @fd={0x66642a85, 0x0, 0xffffffffffffffff, 0x0, 0x2}, @fd={0x66642a85, 0x0, r0, 0x0, 0x4}], &(0x7f0000000080)=[0x20, 0x28, 0x28, 0x30, 0x78]}}, @release, @increfs_done={0x40106308, r1, 0x3}], 0xda, 0x0, &(0x7f00000001c0)="a8c1ad1a33a92171f0fa6243bee7a105df9da35ede55920dd22e32284d34b5219e1b49c37b86322bc608a4651446fe73e66d14387cf4bab128de120b9edb41b72447f2cd326dbc017009feadc4e10041e7fadbda991a01125978ff5fe5b054f6861341110b61ccdbff796f77fad7d48993915f4f17099aae8d6ab75cfefc9592063f6286788b6aecad50a8e087b641288f2b2980e2aafa6ef5b0ddb68e13e7d3fb2947d85fd021acda6af5bacba700ec70adc32366784abab51ff7f9991be254d34c17659b76b56f5adacc75fb6dd78e1c95397bab5f61f6d383"})
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
r2 = openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x40, 0x1)
ioctl$UI_ABS_SETUP(r2, 0x401c5504, &(0x7f0000000380)={0x8, {0x8001, 0x0, 0xa8a, 0x3, 0x9af, 0x400}})
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:27 executing program 3:
r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x4, 0x3)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r5)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
ioctl$GIO_FONTX(r4, 0x4b6b, &(0x7f0000000280)=""/157)

03:36:27 executing program 5:
ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ts_info={0x41, 0x0, 0x800, 0x101, [0x6, 0x10001, 0x4], 0x7ff, [0x3, 0x0, 0x7fff]}})
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = dup(0xffffffffffffffff)
r1 = syz_genetlink_get_family_id$team(&(0x7f0000000140)='team\x00')
getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1b, &(0x7f00000001c0)={@mcast1, <r2=>0x0}, &(0x7f00000002c0)=0x14)
getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000440)={<r3=>0x0, @multicast1, @multicast1}, &(0x7f0000000480)=0xc)
accept4(0xffffffffffffffff, &(0x7f00000004c0)=@ll={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000540)=0x80, 0x800)
getsockname$packet(0xffffffffffffff9c, &(0x7f0000000580)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000005c0)=0x14)
ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000021c0)={'team0\x00', <r6=>0x0})
recvmmsg(0xffffffffffffffff, &(0x7f0000003ec0)=[{{&(0x7f0000002280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000002340)=[{&(0x7f0000002300)=""/46, 0x2e}], 0x1, &(0x7f0000002380)=""/144, 0x90, 0x8}, 0x81}, {{0x0, 0x0, &(0x7f0000002540)=[{&(0x7f0000002440)=""/200, 0xc8}], 0x1, &(0x7f0000002580)=""/5, 0x5, 0x6}, 0x80000001}, {{&(0x7f00000025c0)=@xdp={0x2c, 0x0, <r7=>0x0}, 0x80, &(0x7f0000002b40)=[{&(0x7f0000002640)=""/187, 0xbb}, {&(0x7f0000002700)=""/106, 0x6a}, {&(0x7f0000002780)=""/247, 0xf7}, {&(0x7f0000002880)=""/154, 0x9a}, {&(0x7f0000002940)=""/170, 0xaa}, {&(0x7f0000002a00)=""/80, 0x50}, {&(0x7f0000002a80)=""/130, 0x82}], 0x7, &(0x7f0000002bc0)=""/208, 0xd0, 0x5}, 0x2}, {{&(0x7f0000002cc0)=@in, 0x80, &(0x7f0000002e80)=[{&(0x7f0000002d40)=""/212, 0xd4}, {&(0x7f0000002e40)=""/3, 0x3}], 0x2, &(0x7f0000002ec0)=""/4096, 0x1000, 0x3ff}}], 0x4, 0x42, 0x0)
accept$packet(0xffffffffffffffff, &(0x7f0000003fc0)={0x11, 0x0, <r8=>0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004000)=0x14)
getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000300)={{{@in=@multicast1, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r9=>0x0}}, {{@in=@multicast1}, 0x0, @in=@dev}}, &(0x7f0000004140)=0xe8)
sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000004440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000004400)={&(0x7f0000000600)={0x258, r1, 0x0, 0x70bd2a, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}]}}, {{0x8, 0x1, r4}, {0xbc, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r5}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8}}}]}}, {{0x8, 0x1, r6}, {0xf4, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r7}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r9}}}]}}]}, 0x258}, 0x1, 0x0, 0x0, 0x4000000}, 0x0)
r10 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r10, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r10, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:27 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0x402})
r1 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000000)='/dev/pktcdvd/control\x00', 0x100, 0x0)
ioctl$SG_SCSI_RESET(r1, 0x2284, 0x0)

03:36:27 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0", 0x9)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  419.394938] binder: 12497:12503 got transaction to invalid handle
[  419.403278] device lo entered promiscuous mode
[  419.420145] binder: 12497:12503 transaction failed 29201/-22, size 72-40 line 3013
03:36:27 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0", 0x9)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:27 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
socketpair(0x1, 0x0, 0x100000001, &(0x7f0000000240)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f00000001c0)=0xb5)
r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
getsockname$packet(0xffffffffffffff9c, &(0x7f0000000040)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000080)=0x14)
ioctl$sock_inet6_SIOCDIFADDR(r3, 0x8936, &(0x7f0000000100)={@loopback, 0x72, r4})
ioctl$sock_inet_SIOCRTMSG(r2, 0x890d, &(0x7f0000000280)={0x8, {0x2, 0x4e23, @loopback}, {0x2, 0x4e22, @broadcast}, {0x2, 0x4e23, @broadcast}, 0x40, 0xffffffff, 0x3, 0x80, 0xfffffffffffffeff, &(0x7f0000000140)='gre0\x00', 0x80, 0x100000001, 0x100000000})
setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000200), 0x4)
getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000300)={'ipvs\x00'}, &(0x7f0000000340)=0x1e)

[  419.427919] device lo left promiscuous mode
[  419.430012] device lo entered promiscuous mode
[  419.436796] binder: 12498:12504 ioctl c0306201 20000440 returned -14
03:36:27 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0", 0x9)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  419.436904] device lo left promiscuous mode
[  419.449590] device lo entered promiscuous mode
[  419.450275] binder: 12497:12508 transaction failed 29189/-22, size 0-0 line 3013
[  419.452913] device lo left promiscuous mode
03:36:27 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  419.544173] binder: 12517:12518 ioctl c0306201 20000440 returned -14
[  419.585394] binder: 12524:12525 ioctl c0306201 20000440 returned -14
[  419.598317] binder: 12497:12503 got transaction to invalid handle
[  419.603371] binder: 12497:12527 transaction failed 29189/-22, size 0-0 line 3013
[  419.603594] binder: undelivered TRANSACTION_ERROR: 29189
[  419.619898] device lo entered promiscuous mode
[  419.627092] device lo left promiscuous mode
[  419.629493] binder: 12497:12503 transaction failed 29201/-22, size 72-40 line 3013
[  419.629546] binder: undelivered TRANSACTION_ERROR: 29189
[  419.654676] device lo entered promiscuous mode
[  419.661937] binder: 12528:12532 ioctl c0306201 20000440 returned -14
[  419.671404] device lo entered promiscuous mode
[  419.678643] device lo left promiscuous mode
[  419.684431] device lo left promiscuous mode
[  420.032509] IPVS: Creating netns size=2536 id=99
[  420.067525] IPVS: Creating netns size=2536 id=100
[  420.405041] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  420.413795] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  420.430226] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  420.437872] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  420.528973] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  420.536803] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  420.547284] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  420.557144] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  420.641105] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  420.648931] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  420.659797] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  420.668075] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  420.679337] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  420.689875] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  420.696983] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  420.704514] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  420.714865] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  420.722252] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  420.733509] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  420.747854] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  420.754758] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  420.763635] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  421.838569] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  421.859433] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  421.893019] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  421.899197] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  421.907159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  421.928160] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  421.934480] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  421.941966] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:36:30 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:30 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$EVIOCGBITSW(r0, 0x80404525, &(0x7f0000000000)=""/51)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:30 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:30 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0xffffffffffffffff})
r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x0, 0x0)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f0000000040)={0xfff, 0x6, 0x80000001})

03:36:30 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
listen(0xffffffffffffff9c, 0x1)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:30 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
bind$netlink(r1, &(0x7f0000000200)={0x10, 0x0, 0x25dfdbfc, 0x88000}, 0xc)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000180)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="0300000000000026e987f8fec230bb2db558936b940008001b00000e6cf6fbcaac00000000000000000000000000b35ebe940e395a86b52a7ad52d30b6be189a280ed9e2d02e0043c89c16447dc7d99318c149b83978e14b7d79579e93c1581f24a988ffefa95097a83f893c0869681d33f3fcf20f43f17cf9dcb98e4c5d8370641e1acbbe7fe86f990fb4237fc7539f12a252a1058b5b9beeae13662375a9b91c5d947d0b6a1e495fdb1335cbe11e7c54faf1bd0d89e584cc09f6913e4f50009a1ee1cb2d23532f0c2fbbc1b9191a46003088d40a6447427f51b4e3f642553b"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
ioctl$LOOP_SET_FD(r0, 0x4c00, 0xffffffffffffffff)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:36:30 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f00040000000000000000"], 0x8c)

03:36:30 executing program 4:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
pivot_root(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00')
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

[  423.152607] binder: 13294:13297 ioctl 80404525 20000000 returned -22
[  423.162149] binder_alloc: 13294: binder_alloc_buf failed to map page at 20001000 in userspace
[  423.171506] binder: 13294:13297 transaction failed 29201/-12, size 0-0 line 3136
[  423.179424] device lo entered promiscuous mode
[  423.180949] device lo entered promiscuous mode
03:36:31 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  423.186451] device lo left promiscuous mode
[  423.201330] binder: 13296:13304 ioctl c0306201 20000440 returned -14
[  423.213840] binder_alloc: binder_alloc_mmap_handler: 13294 20001000-20004000 already mapped failed -16
[  423.231759] binder: 13294:13309 ioctl 80404525 20000000 returned -22
[  423.246800] binder: BINDER_SET_CONTEXT_MGR already set
03:36:31 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x10, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:31 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000dca5b37500000000000000000000000000100000000000000000a757b8216c43dbff4000d25500000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

[  423.252348] binder: 13294:13297 ioctl 40046207 0 returned -16
[  423.258761] binder_alloc: 13294: binder_alloc_buf, no vma
[  423.258781] binder: 13294:13309 transaction failed 29189/-3, size 0-0 line 3136
[  423.259042] binder: undelivered TRANSACTION_ERROR: 29189
[  423.259123] binder: undelivered TRANSACTION_ERROR: 29201
[  423.271701] binder: 13313:13314 ioctl c0306201 20000440 returned -14
03:36:31 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x10, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  423.325859] binder: 13317:13319 transaction failed 29189/-22, size 0-0 line 3013
[  423.336226] binder: undelivered TRANSACTION_ERROR: 29189
[  423.347247] binder_alloc: 13321: binder_alloc_buf size -10340440997210136 failed, no address space
[  423.358909] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  423.370907] binder: 13321:13322 transaction failed 29201/-28, size -10340442437036121-1439825984 line 3136
03:36:31 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = gettid()
fcntl$setown(r1, 0x8, r2)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x802, 0x0)
getsockopt$inet6_int(r3, 0x29, 0x48, &(0x7f0000000080), &(0x7f00000000c0)=0x4)

[  423.402951] binder_alloc: 13321: binder_alloc_buf failed to map page at 20001000 in userspace
[  423.412645] binder: 13323:13324 transaction failed 29201/-12, size 0-0 line 3136
[  423.412773] binder_alloc: binder_alloc_mmap_handler: 13321 20001000-20004000 already mapped failed -16
[  423.420440] binder: BINDER_SET_CONTEXT_MGR already set
[  423.420448] binder: 13321:13326 ioctl 40046207 0 returned -16
03:36:31 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x1)
r2 = creat(&(0x7f0000000140)='./file0\x00', 0x200006)
getsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000000c0), 0x10)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340520000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006dfa1b87227673b1258a35656ee49d5837714f8b5a665fb8bc10d5a967e4c95f84f6bae2c1", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

03:36:31 executing program 4:

03:36:31 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000001c0)="dec80be883989b9481b67879d679a790880079143b4e947ce334ecfaa3fc6af8a1398fcaa3a43d25595dd6750fc4ce43172603f6d0774943c6d94ab30d69aeb30d647b5bddd42edf1b8154c0f0a7bc57c04654b2886d0c220f6acf7a9599d0fc10d6a0d1ff5fb8118e8862a563e8a8cafb2ec25550b921fe3c2e7ed21f7e239599f887402154792eda4b2f551bea119373d991dbbef1886c5b25663675a53390be760a5af2b07568d80296d3f9c9f6a70c30a8b20a6a1a4e8f19317e", 0xbc, 0xfffffffffffffffe)
keyctl$revoke(0x3, r1)

[  423.420929] binder: undelivered TRANSACTION_ERROR: 29201
[  423.447669] binder: 13328:13329 ioctl 40046205 1 returned -22
[  423.448359] binder_alloc: 13328: binder_alloc_buf failed to map page at 20001000 in userspace
[  423.448446] binder: 13328:13329 transaction failed 29201/-12, size 0-0 line 3136
[  423.449709] binder_alloc: binder_alloc_mmap_handler: 13328 20001000-20004000 already mapped failed -16
[  423.449813] binder: 13328:13331 ioctl 40046205 1 returned -22
[  423.449895] binder: BINDER_SET_CONTEXT_MGR already set
[  423.449903] binder: 13328:13329 ioctl 40046207 0 returned -16
[  423.450015] binder_alloc: 13328: binder_alloc_buf, no vma
[  423.450032] binder: 13328:13331 transaction failed 29189/-3, size 0-0 line 3136
[  423.450485] binder: undelivered TRANSACTION_ERROR: 29201
[  423.450756] binder: undelivered TRANSACTION_ERROR: 29189
[  423.452795] device lo entered promiscuous mode
[  423.453349] device lo left promiscuous mode
[  423.487075] device lo entered promiscuous mode
[  423.499481] device lo left promiscuous mode
[  423.550477] binder: 13333:13339 unknown command 1379951360
[  423.550486] binder: 13333:13339 ioctl c0306201 20000440 returned -22
03:36:31 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:31 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:31 executing program 4:

03:36:31 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer\x00', 0x200, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:36:31 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000000))
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
recvmsg(r0, &(0x7f00000001c0)={&(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, <r1=>0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, &(0x7f0000000740)=[{&(0x7f0000000240)=""/195, 0xc3}, {&(0x7f0000000340)=""/145, 0x91}, {&(0x7f0000000540)=""/229, 0xe5}, {&(0x7f0000000140)=""/10, 0xa}, {&(0x7f0000000400)=""/127, 0x7f}, {&(0x7f0000000640)=""/202, 0xca}], 0x6, &(0x7f00000007c0)=""/219, 0xdb, 0x7}, 0x40000000)
getpeername$packet(0xffffffffffffff9c, &(0x7f0000000b40)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000b80)=0x14)
ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f0000000bc0)={@dev={0xfe, 0x80, [], 0x1b}, 0x4b, r2})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:31 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'ip6tnl0\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

[  423.555387] binder_alloc: binder_alloc_mmap_handler: 13333 20001000-20004000 already mapped failed -16
[  423.559285] binder: BINDER_SET_CONTEXT_MGR already set
[  423.559293] binder: 13333:13341 ioctl 40046207 0 returned -16
[  423.614772] device lo left promiscuous mode
[  423.617729] device lo entered promiscuous mode
[  423.619965] device lo left promiscuous mode
[  423.677958] binder: undelivered TRANSACTION_ERROR: 29201
[  423.712646] binder: 13347:13355 got transaction to context manager from process owning it
[  423.717600] device lo entered promiscuous mode
[  423.735686] device lo left promiscuous mode
[  423.749973] binder: 13347:13355 transaction failed 29201/-22, size 0-0 line 3004
[  423.771763] binder_alloc: binder_alloc_mmap_handler: 13347 20001000-20004000 already mapped failed -16
[  423.790489] binder: BINDER_SET_CONTEXT_MGR already set
[  423.797243] binder: 13347:13363 ioctl 40046207 0 returned -16
[  423.803843] binder: undelivered TRANSACTION_ERROR: 29201
03:36:31 executing program 4:

03:36:31 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x10, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:31 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
pipe2(&(0x7f0000000000)={<r2=>0xffffffffffffffff}, 0x4800)
setsockopt$ARPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x61, &(0x7f0000000040)={'filter\x00', 0x4}, 0x68)

03:36:31 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:31 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f000400000000000000000000"], 0x8e)

[  423.907879] device lo entered promiscuous mode
[  423.924435] device lo left promiscuous mode
03:36:31 executing program 4:

[  423.978750] binder_alloc: 13378: binder_alloc_buf failed to map page at 20001000 in userspace
[  423.997740] binder: 13378:13379 transaction failed 29201/-12, size 0-0 line 3136
[  423.998018] binder_alloc: 13378: binder_alloc_buf failed to map page at 20001000 in userspace
03:36:31 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:31 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0xa8c7, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TIOCSBRK(r4, 0x5427)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="071a000000000000d78fa87bdf7f8330"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r5)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
clock_adjtime(0x3, &(0x7f0000000280)={0x6, 0x80, 0x7, 0x2, 0x8d, 0x7fff, 0xd8, 0x100000000, 0x2ac, 0xffffffffffff8000, 0x3, 0x100000001, 0xf9a, 0x1, 0x6, 0xffffffff, 0x1, 0xffffffff7fffffff, 0x800, 0x9, 0x400, 0x2, 0xbd2, 0xe8c4bae, 0x7fff, 0x1})

03:36:31 executing program 4:

03:36:31 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'veth0_to_team\x00', 0x8400})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000000000), &(0x7f0000000080)=0x68)

[  424.015301] binder: 13376:13380 transaction failed 29201/-12, size 0-0 line 3136
[  424.017264] binder: undelivered TRANSACTION_ERROR: 29201
[  424.037168] device lo entered promiscuous mode
[  424.039363] device lo left promiscuous mode
[  424.042220] device lo entered promiscuous mode
[  424.044626] device lo left promiscuous mode
[  424.107016] binder_alloc: 13378: binder_alloc_buf failed to map page at 20001000 in userspace
[  424.107588] binder: 13388:13396 transaction failed 29201/-12, size 0-0 line 3136
[  424.108208] binder: undelivered TRANSACTION_ERROR: 29201
[  424.172696] binder_alloc: binder_alloc_mmap_handler: 13378 20001000-20004000 already mapped failed -16
[  424.182421] binder: BINDER_SET_CONTEXT_MGR already set
[  424.188310] binder: 13378:13389 ioctl 40046207 0 returned -16
[  424.194792] binder: undelivered TRANSACTION_ERROR: 29201
[  427.288926] IPVS: Creating netns size=2536 id=101
[  427.460645] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  427.474466] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  427.530331] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  427.543577] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  427.599954] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  427.613307] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  427.627633] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  427.642603] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  428.289553] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  428.323780] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  428.330197] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  428.337192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:36:37 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:37 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:37 executing program 4:

03:36:37 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
preadv(r0, &(0x7f0000000380)=[{&(0x7f00000001c0)=""/139, 0x8b}, {&(0x7f0000000040)=""/109, 0x6d}, {&(0x7f0000000100)=""/33, 0x21}, {&(0x7f0000000280)=""/127, 0x7f}, {&(0x7f0000000300)=""/76, 0x4c}], 0x5, 0x0)
r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0)
ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5)
ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000140)='veth1\x00')

03:36:37 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:37 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
r2 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r3 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000280)='/dev/keychord\x00', 0x4000, 0x0)
openat(r3, &(0x7f00000002c0)='./file0\x00', 0x200000, 0x50)
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
ioctl$TIOCGSID(r4, 0x5429, &(0x7f0000000200))
r5 = getpgid(0xffffffffffffffff)
r6 = syz_open_procfs(r5, &(0x7f0000000240)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r6)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:36:37 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x200, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'veth1\x00', <r3=>0x0})
sendto$packet(r2, &(0x7f0000000140)="4109af79f46f6ccf156a8c71745bcf84fcf937a85f5b4e89bfe71f51c7de1082a135b48106e4abaded4c28e6f546cddea606f91559724985624b317ca1662e5e3d568afa6adff2", 0x47, 0x4000000, &(0x7f00000001c0)={0x11, 0x0, r3, 0x1, 0x100000001, 0x6, @dev={[], 0x19}}, 0x14)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:37 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f000400000000000000000000"], 0x8e)

03:36:37 executing program 4:

03:36:37 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:37 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x40000, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  429.394902] device lo entered promiscuous mode
[  429.401239] binder: 13791:13799 ioctl 8933 200000c0 returned -22
[  429.401533] binder: 13791:13799 transaction failed 29189/-22, size 0-0 line 3013
[  429.418468] binder_alloc: 13791: binder_alloc_buf failed to map page at 20001000 in userspace
03:36:37 executing program 4:

03:36:37 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063c0400000f800000000000000000000000000000000000000000000000000800000000000000000000000000000000000d55b", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})
openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x300, 0x2)

[  429.424448] binder: 13788:13796 transaction failed 29201/-12, size 0-0 line 3136
[  429.426293] binder: undelivered TRANSACTION_ERROR: 29201
03:36:37 executing program 4:

03:36:37 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(0xffffffffffffffff, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:37 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0xa, 0x20010, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
fcntl$dupfd(r0, 0x406, r1)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  429.426767] binder_alloc: binder_alloc_mmap_handler: 13791 20001000-20004000 already mapped failed -16
[  429.432967] binder: 13791:13801 ioctl 8933 200000c0 returned -22
[  429.433040] binder: BINDER_SET_CONTEXT_MGR already set
[  429.433048] binder: 13791:13799 ioctl 40046207 0 returned -16
[  429.433830] binder: undelivered TRANSACTION_ERROR: 29189
[  429.474323] binder_alloc: 13810: binder_alloc_buf failed to map page at 20001000 in userspace
[  429.474363] binder: 13810:13815 transaction failed 29201/-12, size 0-0 line 3136
[  429.475342] binder_alloc: binder_alloc_mmap_handler: 13810 20001000-20004000 already mapped failed -16
[  429.475731] binder: BINDER_SET_CONTEXT_MGR already set
[  429.475739] binder: 13810:13817 ioctl 40046207 0 returned -16
[  429.475928] binder_alloc: 13810: binder_alloc_buf, no vma
[  429.475946] binder: 13810:13817 transaction failed 29189/-3, size 0-0 line 3136
[  429.476123] binder: undelivered TRANSACTION_ERROR: 29201
[  429.476404] binder: undelivered TRANSACTION_ERROR: 29189
[  429.513265] binder: 13812:13816 transaction failed 29189/-22, size 0-0 line 3013
[  429.513594] binder: undelivered TRANSACTION_ERROR: 29189
[  429.531732] binder: BINDER_SET_CONTEXT_MGR already set
[  429.531740] binder: 13823:13824 ioctl 40046207 0 returned -16
[  429.563073] binder: 13829:13830 ioctl c0306201 20000440 returned -14
[  429.570927] binder_alloc: 13832: binder_alloc_buf failed to map page at 20001000 in userspace
[  429.570959] binder: 13832:13834 transaction failed 29201/-12, size 0-0 line 3136
[  429.574724] binder_alloc: binder_alloc_mmap_handler: 13832 20001000-20004000 already mapped failed -16
[  429.574880] binder: BINDER_SET_CONTEXT_MGR already set
[  429.574887] binder: 13832:13834 ioctl 40046207 0 returned -16
[  429.575394] binder: undelivered TRANSACTION_ERROR: 29201
[  429.728974] device lo entered promiscuous mode
[  429.738020] device lo left promiscuous mode
[  429.743776] device lo left promiscuous mode
[  429.798992] device lo entered promiscuous mode
[  429.804817] device lo entered promiscuous mode
[  429.812964] device lo left promiscuous mode
03:36:37 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(0xffffffffffffffff, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:37 executing program 4:

03:36:37 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write$binfmt_misc(r1, &(0x7f0000000000)={'syz0', "b973b0a64a08ed6f3bbd78b0ce76dc5051c465866b9986d4ef79f4f3e4ffb5f7b4a5220a9ee2641f0d0d624dba6964510cf44c10f0bf8a51c09fc8b79ce06b5dc6459f14708afedcf00e9496fb3d3de9c1b3ef86ecec645dce0865c72aae60384f868e8d0186f4a9bdd4cb0daa88658aaacf4b718cc132b52b93d77f1025f379e12c8cb5476cca8de92197cdaeb9c44cb3d91f806917b371307f0eb9f3b9e7359035a7bd5b495a4053dc2a0627470eda508816d19382681f487e108bf60b1673499afc7ea8fab171ae2afa99c0df352d582b956436dd"}, 0xda)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:37 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140), 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:37 executing program 1:
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:37 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/sequencer\x00', 0x40, 0x0)
ioctl$TIOCLINUX6(r2, 0x541c, &(0x7f0000000280)={0x6, 0x4})
r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r4 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008f2650000020000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r5)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:36:37 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
fsync(r0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

[  429.923684] device lo left promiscuous mode
[  429.930230] binder_alloc: 13844: binder_alloc_buf failed to map page at 20001000 in userspace
[  429.930262] binder: 13844:13849 transaction failed 29201/-12, size 0-0 line 3136
[  429.931359] binder: BINDER_SET_CONTEXT_MGR already set
[  429.931368] binder: 13844:13849 ioctl 40046207 0 returned -16
[  429.932195] binder_alloc: 13844: binder_alloc_buf, no vma
[  429.932213] binder: 13844:13855 transaction failed 29189/-3, size 0-0 line 3136
[  429.932540] binder: undelivered TRANSACTION_ERROR: 29189
[  429.932607] binder: undelivered TRANSACTION_ERROR: 29201
[  429.940806] binder: 13842:13852 ioctl c0306201 20000440 returned -14
[  430.028186] device lo entered promiscuous mode
[  430.039078] device lo left promiscuous mode
[  430.098056] device lo entered promiscuous mode
[  430.103812] device lo left promiscuous mode
[  430.111942] device lo entered promiscuous mode
[  430.120536] device lo left promiscuous mode
03:36:38 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f000400000000000000000000"], 0x8e)

03:36:38 executing program 4:

03:36:38 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x4, 0x20011, r0, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000011242c29d2bca476460000000000000000000000000000000000000000a17f5c6fa50ed1864ea8e5c41a3c1f3e6fa5c0ec283c1ff9665dc6c9c6ee37f4560c1c765e491ff3456f64443df3cdb5a0329df315323fef1f841508f11d87de7b496e0087b1e995fcbd3ce589cd3cfc572d503c6fbbfdbbfc0e166037f90000000000006e8634665b5dcd5976ee0b24c83ec8b0bdb055c8d28eec583a", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

03:36:38 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(0xffffffffffffffff, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:38 executing program 1:

03:36:38 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000300)={0x7, 0x3, 0x7, 0xfc8, 0x7}, 0x14)
ioctl$TIOCSCTTY(r1, 0x540e, 0xfff)
socketpair(0xa, 0x80807, 0x9, &(0x7f00000001c0)={0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$EVIOCGPROP(r2, 0x80404509, &(0x7f0000000240)=""/137)
r3 = fcntl$getown(r0, 0x9)
ptrace$setsig(0x4203, r3, 0x1, &(0x7f0000000080)={0x3f, 0xff, 0x4, 0x4})
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x16000, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000340)={"6c6f00000000000000000000000200"})
ioctl$KDGKBMETA(r4, 0x4b62, &(0x7f0000000040))
write$FUSE_LSEEK(r4, &(0x7f0000000140)={0x18, 0xffffffffffffffff, 0x5, {0x400000000000}}, 0x18)

03:36:38 executing program 1:

03:36:38 executing program 4:

03:36:38 executing program 1:
r0 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0), 0x0, 0x0, 0xfffffffffffffffd)
keyctl$get_security(0x11, r0, &(0x7f0000000140)=""/166, 0xa6)

03:36:38 executing program 4:
r0 = socket$inet6_udp(0xa, 0x2, 0x0)
setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @local}}}, 0x165)
getsockopt$inet6_buf(r0, 0x29, 0x30, &(0x7f0000000000)=""/40, &(0x7f00000001c0)=0x114)

[  430.229007] binder: 13872:13878 ioctl c0306201 20000440 returned -14
[  430.239708] binder_alloc: 13871: binder_alloc_buf, no vma
[  430.239728] binder: 13871:13877 transaction failed 29189/-3, size 302638218450-0 line 3136
[  430.254532] binder: BINDER_SET_CONTEXT_MGR already set
[  430.254540] binder: 13871:13882 ioctl 40046207 0 returned -16
[  430.254935] binder: undelivered TRANSACTION_ERROR: 29189
[  430.256417] device lo entered promiscuous mode
[  430.262885] device lo left promiscuous mode
[  430.424625] device lo entered promiscuous mode
[  430.430949] device lo left promiscuous mode
[  432.878782] IPVS: Creating netns size=2536 id=102
[  433.048313] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  433.061971] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  433.120173] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  433.133860] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  433.190404] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  433.204244] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  433.218918] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  433.233139] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  433.882985] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  433.917436] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  433.923537] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  433.930959] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:36:42 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140), 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:42 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040e30000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

03:36:42 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x200, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'veth1\x00', <r3=>0x0})
sendto$packet(r2, &(0x7f0000000140)="4109af79f46f6ccf156a8c71745bcf84fcf937a85f5b4e89bfe71f51c7de1082a135b48106e4abaded4c28e6f546cddea606f91559724985624b317ca1662e5e3d568afa6adff2", 0x47, 0x4000000, &(0x7f00000001c0)={0x11, 0x0, r3, 0x1, 0x100000001, 0x6, @dev={[], 0x19}}, 0x14)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:42 executing program 4:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0xa8c7, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$TIOCSBRK(r4, 0x5427)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="071a000000000000d78fa87bdf7f8330"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r5)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
clock_adjtime(0x3, &(0x7f0000000280)={0x6, 0x80, 0x7, 0x2, 0x8d, 0x7fff, 0xd8, 0x100000000, 0x2ac, 0xffffffffffff8000, 0x3, 0x100000001, 0xf9a, 0x1, 0x6, 0xffffffff, 0x1, 0xffffffff7fffffff, 0x800, 0x9, 0x400, 0x2, 0xbd2, 0xe8c4bae, 0x7fff, 0x1})

03:36:42 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="03000004003586c80200d829000873"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x4, 0x121200)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:36:42 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, 0xffffffffffffffff, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:42 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
bind(r0, &(0x7f0000000240)=@rc={0x1f, {0x7, 0x5, 0x9, 0x4, 0xe11, 0x1}, 0x4}, 0x80)
clock_gettime(0x0, &(0x7f0000000000)={<r1=>0x0, <r2=>0x0})
setitimer(0x1, &(0x7f0000000040)={{r1, r2/1000+10000}, {0x77359400}}, 0x0)

03:36:42 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f00040000000000000000000000"], 0x8f)

03:36:42 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x44)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  434.981114] binder: 14280:14285 ioctl c0306201 20000440 returned -14
03:36:42 executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140), 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

[  434.983195] binder: 14279:14286 got transaction to invalid handle
[  434.983203] binder: 14279:14286 transaction failed 29201/-22, size 0-0 line 3013
03:36:42 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x12)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
creat(&(0x7f0000000080)='./file0\x00', 0x88)
r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x20000, 0x0)
ioctl$LOOP_SET_CAPACITY(r2, 0x4c07)
setsockopt$inet6_tcp_TLS_RX(r2, 0x6, 0x2, &(0x7f0000000040), 0x4)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  434.990588] binder: 14281:14287 ioctl 8933 200000c0 returned -22
[  434.990798] binder: BINDER_SET_CONTEXT_MGR already set
[  434.990807] binder: 14281:14287 ioctl 40046207 0 returned -16
03:36:42 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
keyctl$session_to_parent(0x12)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  434.991323] binder: 14281:14287 transaction failed 29189/-22, size 0-0 line 3013
[  434.991559] binder: undelivered TRANSACTION_ERROR: 29189
[  434.994672] binder: BINDER_SET_CONTEXT_MGR already set
[  434.994680] binder: 14279:14286 ioctl 40046207 0 returned -16
[  434.994758] binder: 14279:14291 got transaction to invalid handle
03:36:43 executing program 7:
sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000240))
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x80000, 0x0)
ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f0000000140)=""/203)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYRES32=r1, @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYRES32=r0], 0x0, 0x0, &(0x7f00000003c0)})
syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0)
r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x0, 0x0)
ioctl$RTC_ALM_SET(r3, 0x40247007, &(0x7f0000000080)={0x23, 0x29, 0xa, 0x18, 0x5, 0x80000000, 0x4, 0xd8})
write$selinux_access(r3, &(0x7f0000000280)={'system_u:object_r:policy_src_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0xffffffffffffffa6}, 0x4e)

[  434.994767] binder: 14279:14291 transaction failed 29201/-22, size 0-0 line 3013
[  434.994915] binder: undelivered TRANSACTION_ERROR: 29201
[  434.995429] binder: undelivered TRANSACTION_ERROR: 29201
[  435.003521] device lo entered promiscuous mode
[  435.011879] device lo left promiscuous mode
[  435.055398] binder_alloc: binder_alloc_mmap_handler: 14296 20001000-20004000 already mapped failed -16
[  435.055500] binder: BINDER_SET_CONTEXT_MGR already set
[  435.055508] binder: 14296:14301 ioctl 40046207 0 returned -16
[  435.055814] binder: send failed reply for transaction 244 to 14296:14299
[  435.055886] binder: undelivered TRANSACTION_COMPLETE
[  435.055892] binder: undelivered TRANSACTION_ERROR: 29189
[  435.102981] binder_alloc: binder_alloc_mmap_handler: 14307 20001000-20004000 already mapped failed -16
[  435.108972] binder: BINDER_SET_CONTEXT_MGR already set
[  435.108980] binder: 14307:14309 ioctl 40046207 0 returned -16
03:36:43 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x400, 0x0)
setsockopt$netlink_NETLINK_PKTINFO(r2, 0x10e, 0x3, &(0x7f0000000040)=0x48, 0x4)

[  435.114462] binder: send failed reply for transaction 246 to 14307:14308
[  435.114521] binder: undelivered TRANSACTION_COMPLETE
[  435.114528] binder: undelivered TRANSACTION_ERROR: 29189
[  435.184030] binder: 14313:14314 transaction failed 29189/-22, size 0-0 line 3013
[  435.189729] binder_alloc: binder_alloc_mmap_handler: 14313 20001000-20004000 already mapped failed -16
[  435.190121] binder: BINDER_SET_CONTEXT_MGR already set
03:36:43 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
socket$inet_icmp_raw(0x2, 0x3, 0x1)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
r2 = memfd_create(&(0x7f0000000000)='/dev/binder#\x00', 0x2)
ioctl$LOOP_SET_FD(r2, 0x4c00, r1)
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2)
openat$cgroup_type(r2, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:43 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

[  435.190128] binder: 14313:14315 ioctl 40046207 0 returned -16
[  435.194342] binder: undelivered TRANSACTION_ERROR: 29189
[  435.235592] binder: 14319:14320 unknown command 4
[  435.235601] binder: 14319:14320 ioctl c0306201 20000440 returned -22
[  435.256948] binder: BINDER_SET_CONTEXT_MGR already set
[  435.256957] binder: 14319:14320 ioctl 40046207 0 returned -16
[  435.262413] binder: 14319:14321 unknown command 9
[  435.262421] binder: 14319:14321 ioctl c0306201 20000440 returned -22
[  435.301585] binder_alloc: 14323: binder_alloc_buf failed to map page at 20001000 in userspace
[  435.315572] binder: 14323:14325 transaction failed 29201/-12, size 0-0 line 3136
[  435.317480] device lo entered promiscuous mode
[  435.319885] binder_alloc: binder_alloc_mmap_handler: 14323 20001000-20004000 already mapped failed -16
[  435.319983] binder: BINDER_SET_CONTEXT_MGR already set
[  435.319990] binder: 14323:14326 ioctl 40046207 0 returned -16
03:36:43 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
write$P9_RLINK(r1, &(0x7f0000000040)={0x7, 0x47, 0x1}, 0x7)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
ioctl$BLKGETSIZE64(r0, 0x80081272, &(0x7f0000000000))

03:36:43 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000de2d2e7ef0f3777f00000000000000000000000000000075c2b12da6da35cb43a7a3315dfbe6b70000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})
r2 = dup(r1)
ioctl$BLKSECTGET(r2, 0x1267, &(0x7f0000000000))

03:36:43 executing program 4:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000000))
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
recvmsg(r0, &(0x7f00000001c0)={&(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, <r1=>0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, &(0x7f0000000740)=[{&(0x7f0000000240)=""/195, 0xc3}, {&(0x7f0000000340)=""/145, 0x91}, {&(0x7f0000000540)=""/229, 0xe5}, {&(0x7f0000000140)=""/10, 0xa}, {&(0x7f0000000400)=""/127, 0x7f}, {&(0x7f0000000640)=""/202, 0xca}], 0x6, &(0x7f00000007c0)=""/219, 0xdb, 0x7}, 0x40000000)
getpeername$packet(0xffffffffffffff9c, &(0x7f0000000b40)={0x11, 0x0, <r2=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000b80)=0x14)
ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f0000000bc0)={@dev={0xfe, 0x80, [], 0x1b}, 0x4b, r2})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:43 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140), 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:43 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000800000008001b001b000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000200)=[{0x2, 0x5}, {0x3, 0x1}, {0x4, 0x400}, {0xc, 0x6}], 0x4)
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

[  435.320090] binder_alloc: 14323: binder_alloc_buf, no vma
[  435.320107] binder: 14323:14325 transaction failed 29189/-3, size 0-0 line 3136
[  435.320543] binder: undelivered TRANSACTION_ERROR: 29189
[  435.320604] binder: undelivered TRANSACTION_ERROR: 29201
[  435.321558] device lo left promiscuous mode
[  435.351399] binder_alloc: 14328: binder_alloc_buf failed to map page at 20001000 in userspace
[  435.351428] binder: 14328:14329 transaction failed 29201/-12, size 0-0 line 3136
[  435.352693] binder: BINDER_SET_CONTEXT_MGR already set
[  435.352701] binder: 14328:14329 ioctl 40046207 0 returned -16
[  435.352741] binder_alloc: 14328: binder_alloc_buf, no vma
[  435.352757] binder: 14328:14330 transaction failed 29189/-3, size 0-0 line 3136
[  435.353171] binder: undelivered TRANSACTION_ERROR: 29189
[  435.353232] binder: undelivered TRANSACTION_ERROR: 29201
[  435.404981] binder: 14332:14333 got transaction to invalid handle
[  435.404990] binder: 14332:14333 transaction failed 29201/-22, size 0-0 line 3013
[  435.414292] binder_alloc: binder_alloc_mmap_handler: 14332 20001000-20004000 already mapped failed -16
[  435.418843] binder: BINDER_SET_CONTEXT_MGR already set
[  435.418850] binder: 14332:14334 ioctl 40046207 0 returned -16
[  435.419245] binder: undelivered TRANSACTION_ERROR: 29201
[  435.512475] device lo entered promiscuous mode
[  435.523787] binder_alloc: 14340: binder_alloc_buf size 6715328458190429408 failed, no address space
[  435.523794] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  435.523813] binder: 14340:14344 transaction failed 29201/-28, size 6715328458178377178-12052219 line 3136
[  435.524591] binder: 14340:14344 ioctl 1267 20000000 returned -22
[  435.534015] device lo left promiscuous mode
03:36:43 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, 0xffffffffffffffff, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:43 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'veth0_to_bond\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={'lo\x00'})

03:36:43 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x3)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0xfffffffffffffffd)
r2 = mmap$binder(&(0x7f0000004000/0x3000)=nil, 0x3000, 0x7, 0x10010, r0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0xd4, 0x0, &(0x7f0000000140)=[@clear_death={0x400c630f, 0x2, 0x1}, @decrefs, @acquire_done={0x40106309, r2, 0x2}, @register_looper, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x38, 0x10, &(0x7f0000000000)=[@fda={0x66646185, 0x6, 0x2, 0x2e}, @fd={0x66642a85, 0x0, r1, 0x0, 0x3}], &(0x7f0000000040)=[0x18, 0x78]}}, @decrefs={0x40046307, 0x1}, @dead_binder_done={0x40086310, 0x4}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30, &(0x7f0000000080), &(0x7f00000000c0)=[0x78, 0x0, 0x78, 0x40, 0x20, 0x40]}, 0xd2}}], 0xe8, 0x0, &(0x7f0000000480)="e0357bee3508536b1ac00ecad58e885b99e98d243891d4b5c44e4242b1bf45177a8d12e95a01bea80bc18d0137c51396c5ad3bf351f288d8f45f50aab876f9cdc639cd5d2f90e4565a00ba7f6977a02e8714cd1a97d525de7dfbf758711856176a36d262ed3dcbba3ded4f9bf41b2daca74ed16db3178f79d5016380e21cc8f8d1272b39b1c7ff79318f450a9b53d2587e8a8afb629ccf687e121512eb4497d550378ae36cc16b0bca53470a100cdd3e41576eb97ee46f021806b197f903424de1117beebada6b0d75098663e2c5f63da7cfc5ba19a9511a2429427a8f12ea211b56fde764c43cf9"})
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000280)=<r3=>0x0)
get_robust_list(r3, &(0x7f00000005c0)=&(0x7f0000000580)={&(0x7f0000000380)={&(0x7f00000002c0)}, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)}}, &(0x7f0000000600)=0x18)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:43 executing program 4:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x10000000003, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000000))
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
r2 = userfaultfd(0x80000)
ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000fff000/0x1000)=nil, 0x1000})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

[  435.537082] binder_alloc: binder_alloc_mmap_handler: 14340 20001000-20004000 already mapped failed -16
[  435.537920] binder: BINDER_SET_CONTEXT_MGR already set
[  435.537930] binder: 14340:14348 ioctl 40046207 0 returned -16
[  435.538102] binder_alloc: 14340: binder_alloc_buf, no vma
[  435.538135] binder: 14340:14344 transaction failed 29189/-3, size 6715328458178377178-12052219 line 3136
[  435.538539] binder: undelivered TRANSACTION_ERROR: 29201
[  435.538876] binder: undelivered TRANSACTION_ERROR: 29189
[  435.791931] binder: 14358:14359 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2
[  435.800612] binder: 14358:14359 DecRefs 0 refcount change on invalid ref 0 ret -22
[  435.811481] device veth0_to_bond entered promiscuous mode
[  435.812657] device lo entered promiscuous mode
03:36:43 executing program 1:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x10000000003, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000000))
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
r2 = userfaultfd(0x80000)
ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000fff000/0x1000)=nil, 0x1000})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:43 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f00040000000000000000000000"], 0x8f)

03:36:43 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
r2 = accept4(r1, &(0x7f0000000000)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x80, 0x80800)
r3 = syz_genetlink_get_family_id$team(&(0x7f00000001c0)='team\x00')
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @local}}}, &(0x7f0000000340)=0xe8)
accept$packet(0xffffffffffffff9c, &(0x7f0000001940)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000001980)=0x14)
ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000019c0)={'team0\x00', <r6=>0x0})
creat(&(0x7f00000003c0)='./file0\x00', 0x0)
getpeername$packet(0xffffffffffffffff, &(0x7f0000001a00)={0x11, 0x0, <r7=>0x0}, &(0x7f0000001a40)=0x14)
clock_gettime(0x0, &(0x7f000000a040)={<r8=>0x0, <r9=>0x0})
recvmmsg(r1, &(0x7f0000009ec0)=[{{&(0x7f0000001a80)=@llc, 0x80, &(0x7f0000004f80)=[{&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/196, 0xc4}, {&(0x7f0000002c00)=""/200, 0xc8}, {&(0x7f0000002d00)=""/226, 0xe2}, {&(0x7f0000002e00)=""/117, 0x75}, {&(0x7f0000002e80)=""/4096, 0x1000}, {&(0x7f0000003e80)=""/4096, 0x1000}, {&(0x7f0000004e80)=""/211, 0xd3}], 0x8, 0x0, 0x0, 0xa07b}, 0x20}, {{&(0x7f0000005000)=@hci={0x1f, <r10=>0x0}, 0x80, &(0x7f0000005080), 0x0, &(0x7f00000050c0)=""/25, 0x19}, 0x9}, {{&(0x7f0000005100)=@pppoe={0x18, 0x0, {0x0, @random}}, 0x80, &(0x7f0000005180), 0x0, &(0x7f00000051c0)=""/4096, 0x1000}, 0x9}, {{&(0x7f00000061c0)=@nfc_llcp, 0x80, &(0x7f0000007240)=[{&(0x7f0000006240)=""/4096, 0x1000}], 0x1, &(0x7f0000007280)=""/231, 0xe7, 0x8}, 0x1ff}, {{&(0x7f0000007380)=@in={0x2, 0x0, @remote}, 0x80, &(0x7f0000008680)=[{&(0x7f0000007400)=""/25, 0x19}, {&(0x7f0000007440)=""/150, 0x96}, {&(0x7f0000007500)=""/122, 0x7a}, {&(0x7f0000007580)=""/233, 0xe9}, {&(0x7f0000007680)=""/4096, 0x1000}], 0x5, &(0x7f0000008700)=""/41, 0x29}, 0x401}, {{&(0x7f0000008740)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000009d80)=[{&(0x7f00000087c0)=""/107, 0x6b}, {&(0x7f0000008840)=""/118, 0x76}, {&(0x7f00000088c0)=""/4096, 0x1000}, {&(0x7f00000098c0)=""/112, 0x70}, {&(0x7f0000009940)=""/180, 0xb4}, {&(0x7f0000009a00)=""/136, 0x88}, {&(0x7f0000009ac0)=""/133, 0x85}, {&(0x7f0000009b80)=""/52, 0x34}, {&(0x7f0000009bc0)=""/198, 0xc6}, {&(0x7f0000009cc0)=""/153, 0x99}], 0xa, &(0x7f0000009e40)=""/70, 0x46, 0x6}, 0x5}], 0x6, 0x1, &(0x7f000000a080)={r8, r9+10000000})
getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f000000a0c0)={{{@in6=@remote, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r11=>0x0}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f000000a1c0)=0xe8)
getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f000000a200)={<r12=>0x0, @empty, @multicast1}, &(0x7f000000a240)=0xc)
getsockname$packet(0xffffffffffffffff, &(0x7f000000a380)={0x11, 0x0, <r13=>0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f000000a3c0)=0x14)
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f000000a400)={{{@in=@loopback, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r14=>0x0}}, {{@in=@multicast1}}}, &(0x7f000000a500)=0xe8)
ioctl$IOC_PR_PREEMPT_ABORT(r0, 0x401870cc, &(0x7f0000000380)={0x7, 0x8, 0x0, 0x2})
sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f000000a900)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0xa0}, 0xc, &(0x7f000000a8c0)={&(0x7f000000a540)=ANY=[@ANYBLOB="50030000", @ANYRES16=r3, @ANYBLOB="000827bd7000fddbdf250300000008000100", @ANYRES32=r4, @ANYBLOB="800002003c000100240001006c625f74785f6d6574686f64000000000000000100000000000000000000000008000300050000000c000400686173680000000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b0000000800040000000000080007000000000008000100", @ANYRES32=r5, @ANYBLOB="b80002003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r6, @ANYBLOB="7c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000004c00040003000800a20700000800740807000000001001079e0300000000d4070300000001000300ffffff7f0700040403000000000008b6b30800000000090908000000ffff01f55500000008000100", @ANYRES32=r7, @ANYBLOB="6801020038000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000080003000300000008000400ffff000040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004000100000008000600", @ANYRES32=r10, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004009c11000008000600", @ANYRES32=r11, @ANYBLOB="3c000100240001006d6f64650000000000000000000000000000000000000000000000000000000008000300050000000c00040072616e646f6d000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004000100008038000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000800030003000000080004000800000008000100", @ANYRES32=r12, @ANYBLOB="7c0002003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r13, @ANYBLOB="3c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r14], 0x350}, 0x1, 0x0, 0x0, 0x4000005}, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:43 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, 0xffffffffffffffff, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  435.842544] binder: 14358:14359 BC_ACQUIRE_DONE u0000000000000000 no match
[  435.852084] binder: 14358:14369 transaction failed 29189/-22, size 0-0 line 3013
03:36:43 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="037975ffff08001b00000000003b5bb2caa46fd0a4ee7ddfa7a498464db4d97b70919d126dc26bc72053c95b6ec2b1d04824ea26b39e6bba60f569c1524bb83316355c5d722ce0dc214c8c178b686a90ec853e35dc76f00be3f4b3881bd72a71c383cef42ade58cf0da84d598045c361b2bb2d2fe8ea40dc8b6cbd1c6dc4c737237c179a5040bd96aec2575b1caaf3c18f12ae922d0c6d000f74057ac25a7787e820a005064527d01d078e658beebbaa92dbeba87e16b3f49fdad38ea243bd71c5c0156744bda5fc09759cea51d146727a8b5e48d250c8c64914ef10ad92e4d82823aad5dee2c2fd6c7a867c9941e9f0f63afa5db76050d8e7297c1d59c2d5f5534ce21301508389f4676eb0635e9a091b499f16869093adfbf97f5305db8c81b0b1f021957c32b5c4236581a22ac69d800d7535c15f624ad2662155c43026e2f359c6fe186628833ed426204a8797a509731bfdc6a77933c89bddb8e6ab028b136fefc70dabefbd628763aff60bddbc00f1ac0cada1ea1cbfa09f46181a0b485c006f087700f869cd4d2f040cb86813003864"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
ioctl$BLKPG(r1, 0x1269, &(0x7f0000000200)={0x8, 0x3, 0x96, &(0x7f0000000280)="351fbb43fc93691c88aada3e31221de8176656d0c8d1c46eb27caecb68d9df5579625d668d6353a83f9801add4efbdb08d5e3dec9146f74d2e5912f00f7f8d6256bacf18b116a2ef4b7ed07dccd4d4fb9a9b836ec09357f16fa6bea86437abd9418b0e9d681223d59680341e8e340a0cd19ba8c639fb7c0c243b96754c6cbb1626b719defc674f0049f2171da9f624c8464c9664d1fb"})
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:36:43 executing program 4:
r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000)
getsockopt$inet6_tcp_int(r0, 0x6, 0x18, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r2 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r4 = socket$nl_route(0x10, 0x3, 0x0)
r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
socketpair(0x1f, 0x80a, 0x81, &(0x7f0000000300))
sendmsg$nl_route(r6, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRESDEC=r5], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r7 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r1, 0x4c00, r7)
ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2)
ioctl$sock_proto_private(r4, 0x89ea, &(0x7f0000000180)="de70fdfc85d0ab")

03:36:43 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  435.852586] binder: 14364:14366 ioctl c0306201 20000440 returned -14
[  435.854241] device lo left promiscuous mode
[  435.898715] binder: 14358:14359 ERROR: BC_REGISTER_LOOPER called without request
[  435.917496] device lo entered promiscuous mode
[  435.926926] binder: 14358:14359 got transaction to invalid handle
[  435.930145] binder: 14376:14377 ioctl c0306201 20000440 returned -14
03:36:43 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
r2 = dup2(r0, r1)
ioctl$PIO_UNIMAPCLR(r2, 0x4b68, &(0x7f0000000000)={0x3, 0x8, 0x6})
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  435.974550] binder: 14385:14388 ioctl c0306201 20000440 returned -14
[  435.978977] binder: 14358:14359 transaction failed 29201/-22, size 56-16 line 3013
[  435.996100] binder: 14358:14393 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2
[  435.996113] binder: 14358:14393 DecRefs 0 refcount change on invalid ref 0 ret -22
[  435.996129] binder: 14358:14393 BC_ACQUIRE_DONE u0000000000000000 node 261 cookie mismatch 0000000000000002 != 0000000000000000
[  435.996139] binder: 14358:14393 ERROR: BC_REGISTER_LOOPER called without request
[  435.996147] binder: 14358:14393 got transaction to invalid handle
[  435.996155] binder: 14358:14393 transaction failed 29201/-22, size 56-16 line 3013
[  435.996354] binder: BINDER_SET_CONTEXT_MGR already set
[  435.996361] binder: 14358:14369 ioctl 40046207 0 returned -16
[  435.996717] binder: undelivered TRANSACTION_ERROR: 29189
[  436.000166] device lo left promiscuous mode
[  436.038688] binder: 14399:14400 ioctl 4b68 20000000 returned -22
[  436.038853] binder: 14399:14400 got transaction to context manager from process owning it
[  436.038865] binder: 14399:14400 transaction failed 29201/-22, size 0-0 line 3004
[  436.043306] binder: 14399:14400 ioctl 4b68 20000000 returned -22
[  436.043334] binder: BINDER_SET_CONTEXT_MGR already set
[  436.043342] binder: 14399:14401 ioctl 40046207 0 returned -16
[  436.053744] binder: undelivered TRANSACTION_ERROR: 29201
[  436.183522] device lo entered promiscuous mode
[  436.207121] device lo left promiscuous mode
[  436.501924] IPVS: Creating netns size=2536 id=103
[  436.691054] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  436.708135] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  436.785943] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  436.800940] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  436.878288] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  436.892168] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  436.906888] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  436.921846] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  437.571657] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  437.605679] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  437.611808] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  437.619638] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:36:46 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db10", 0x2)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:46 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
mmap$binder(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0, 0x810, r0, 0x0)

03:36:46 executing program 1:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x10000000003, 0x0)
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000000))
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
r2 = userfaultfd(0x80000)
ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000fff000/0x1000)=nil, 0x1000})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:46 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:46 executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:46 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = getpgid(0xffffffffffffffff)
ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r1, 0x10, &(0x7f0000000000))
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:46 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000002c0)="754d6faf2d0c9672d95fb4f80c704bf682c443c8bab75ac25f4753ab6ba9e0c643fa769d7075a9a5ef7ea9d97d5e81db3a19d48ab08faf9e9f310990a2dbe685928e412e58552a71db171e0e211f31baa0692c7082d59f91960bd19db74ac7d9f5e7a206247f98ce5be7455dc37e4b29f46072557c983f73ab1986ea689da58431c5c594d5145fd3016a965fb4dc5cb944b8bd5df45a11d0936fc621163ce599e302a30c5ea1f6cecfe531cefe3b75969d990c537e0a9ddd12f899c52c5286508d25854ef7823867e463bb001bd0933f10b2d200e3476bd0450dff4edde77a811e31d9e518e5b9d5e955a7a1decc7595a9361cca2ddeceb6aa9976827a5e4469")
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f0000000440), 0xc, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[]}}, 0x2)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
syz_open_dev$usbmon(&(0x7f0000000200)='/dev/usbmon#\x00', 0x6, 0x2000)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:36:46 executing program 2:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f00040000000000000000000000"], 0x8f)

03:36:46 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x10000, 0x0)
ioctl$GIO_FONT(r2, 0x4b60, &(0x7f0000000040)=""/140)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
r3 = add_key(&(0x7f0000000200)='cifs.idmap\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000000380)="0a366236eb57b91264cffbe50720d58a7348553cb6a73f44358aadb90bcf8c3e4a7475ccfd529624e47e7e48f8d72f303c103a6a15fcd625c9ba2307625f9330d1d2d0ba6e7f33fd4274e5bd14c6cc56a78c876857104ca7ea361044dec0fc709171c5b81cabf4c09aa8128e0c8824251411d113ff6442be94e2ed3eba4221c0b478bfca753e3096e117a397f0ccd11ba664b40b18fa89", 0x97, 0xfffffffffffffff8)
keyctl$revoke(0x3, r3)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00403a400000f200001801000010000000000000000000000000000000000000002000000060bf2325688d319c822276ac6a", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})
ioctl$sock_inet_SIOCGIFNETMASK(r2, 0x891b, &(0x7f0000000280)={'bond_slave_0\x00', {0x2, 0x4e24, @local}})
accept4$packet(r2, &(0x7f0000000140)={0x11, 0x0, <r4=>0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000180)=0x14, 0x0)
ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f00000001c0)={@loopback, 0x78, r4})

[  438.668742] binder: 14789:14792 ioctl c0306201 20000440 returned -14
[  438.674971] binder_alloc: 14787: binder_alloc_buf failed to map page at 20001000 in userspace
03:36:46 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = dup3(r0, r0, 0x80000)
setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000000)={0x20, 0x0, 0x1, 0x7fff, 0x4}, 0x14)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  438.675478] binder: 14787:14790 transaction failed 29201/-12, size 0-0 line 3136
[  438.679917] device lo entered promiscuous mode
[  438.681784] binder_alloc: binder_alloc_mmap_handler: 14787 20001000-20004000 already mapped failed -16
03:36:46 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x2, 0x7, 0x8000, 0x4, 0x7ff})
r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x80, 0x0)
ioctl$TIOCLINUX5(r1, 0x541c, &(0x7f0000000080)={0x5, 0x1ff, 0x3, 0x5317, 0xfc3e})
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  438.681987] binder: BINDER_SET_CONTEXT_MGR already set
[  438.681994] binder: 14787:14799 ioctl 40046207 0 returned -16
[  438.682242] binder_alloc: 14787: binder_alloc_buf, no vma
03:36:46 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
fcntl$getownex(r1, 0x10, &(0x7f0000000000)={0x0, <r2=>0x0})
sched_setparam(r2, &(0x7f0000000040)=0x3)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  438.682258] binder: 14787:14790 transaction failed 29189/-3, size 0-0 line 3136
[  438.683447] binder: undelivered TRANSACTION_ERROR: 29189
[  438.683509] binder: undelivered TRANSACTION_ERROR: 29201
[  438.683922] device lo left promiscuous mode
[  438.741915] binder: 14802:14803 unknown command 1077559296
03:36:46 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000000)={{{@in=@multicast1, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0}}, {{@in6=@mcast2}, 0x0, @in=@multicast2}}, &(0x7f0000000140)=0xe8)
setreuid(0x0, r1)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  438.741924] binder: 14802:14803 ioctl c0306201 20000440 returned -22
[  438.751169] binder: BINDER_SET_CONTEXT_MGR already set
[  438.751177] binder: 14802:14803 ioctl 40046207 0 returned -16
[  438.752270] binder: 14802:14806 unknown command 1077559296
[  438.752278] binder: 14802:14806 ioctl c0306201 20000440 returned -22
[  438.818844] binder_alloc: 14809: binder_alloc_buf failed to map page at 20001000 in userspace
03:36:46 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x2000000, 0x8010, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000380)={<r3=>0x0})
r4 = mmap$binder(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x5, 0x110, r0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x130, 0x0, &(0x7f0000000480)=[@reply={0x40406301, {0x2, 0x0, 0x4, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000080)=[@fd={0x66642a85, 0x0, r1, 0x0, 0x3}, @ptr={0x70742a85, 0x0, &(0x7f0000000000), 0x1, 0x2, 0x21}, @ptr={0x70742a85, 0x1, &(0x7f0000000040), 0x1, 0x4, 0x2e}], &(0x7f0000000140)=[0x28, 0x20, 0x70]}}, @transaction={0x40406300, {0x2, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x58, 0x50, &(0x7f0000000180)=[@fda={0x66646185, 0x6, 0x2, 0x22}, @flat={0x73682a85, 0x10b, r2, 0x2}, @fda={0x66646185, 0x1, 0x0, 0x31}], &(0x7f0000000200)=[0x78, 0x40, 0x0, 0x48, 0x0, 0x0, 0x20, 0x38, 0x18, 0x48]}}, @transaction={0x40406300, {0x1, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000280), &(0x7f00000002c0)=[0x38]}}, @transaction={0x40406300, {0x1, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x30, 0x20, &(0x7f00000003c0)=[@flat={0x73622a85, 0x10b, r3, 0x4}, @flat={0x776a2a85, 0x10b, r4, 0x3}], &(0x7f0000000400)=[0x28, 0x0, 0x40, 0x18]}}, @increfs={0x40046304, 0x3}, @acquire={0x40046305, 0x4}, @release={0x40046306, 0x1}, @acquire={0x40046305, 0x2}], 0x2f, 0x0, &(0x7f00000005c0)="bc3d2c2a641b90eeaea3304cfdc9fefdc020fa2c99ecd7ea9420b75eda8f8d10e0962827e75c6e253b80798c648b81"})
madvise(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000800001)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003ca6", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

[  438.818903] binder: 14809:14812 transaction failed 29201/-12, size 0-0 line 3136
[  438.821571] binder_alloc: binder_alloc_mmap_handler: 14809 20001000-20004000 already mapped failed -16
[  438.821720] binder: BINDER_SET_CONTEXT_MGR already set
[  438.821728] binder: 14809:14813 ioctl 40046207 0 returned -16
[  438.821843] binder_alloc: 14809: binder_alloc_buf, no vma
[  438.821861] binder: 14809:14812 transaction failed 29189/-3, size 0-0 line 3136
[  438.822112] binder: undelivered TRANSACTION_ERROR: 29189
[  438.822174] binder: undelivered TRANSACTION_ERROR: 29201
[  438.853843] binder: 14817:14818 ioctl 801c581f 20000000 returned -22
[  438.854586] binder: 14817:14818 transaction failed 29189/-22, size 0-0 line 3013
[  438.855697] binder: 14817:14818 ioctl 801c581f 20000000 returned -22
[  438.856926] binder: undelivered TRANSACTION_ERROR: 29189
03:36:46 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = creat(&(0x7f0000000080)='./file0\x00', 0x1)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0)
getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000140)={{{@in=@multicast1, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in=@local}}}, &(0x7f00000000c0)=0xe8)
ioprio_set$uid(0x3, r4, 0x1)
openat(r3, &(0x7f0000000240)='./file0\x00', 0x1, 0x141)
write$P9_RSYMLINK(r3, &(0x7f0000000040)={0x14, 0x11, 0x2, {0x10, 0x1, 0x7}}, 0x14)
madvise(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:46 executing program 5:
perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, @perf_config_ext={0x3, 0x10000}, 0x0, 0x2000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/checkreqprot\x00', 0x80000, 0x0)
getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000100), &(0x7f0000000140)=0x30)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

[  438.891838] binder: 14821:14822 got transaction to context manager from process owning it
[  438.891852] binder: 14821:14822 transaction failed 29201/-22, size 0-0 line 3004
[  438.902782] binder_alloc: binder_alloc_mmap_handler: 14821 20001000-20004000 already mapped failed -16
[  438.910741] binder: BINDER_SET_CONTEXT_MGR already set
[  438.910750] binder: 14821:14823 ioctl 40046207 0 returned -16
[  438.911165] binder: undelivered TRANSACTION_ERROR: 29201
03:36:47 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db10", 0x2)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:47 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802)

[  438.980004] binder: BINDER_SET_CONTEXT_MGR already set
[  438.980012] binder: 14825:14826 ioctl 40046207 0 returned -16
[  438.981962] device lo entered promiscuous mode
[  438.990780] device lo left promiscuous mode
[  439.008946] IPVS: Creating netns size=2536 id=104
[  439.019336] binder: 14832:14834 got reply transaction with no transaction stack
[  439.019345] binder: 14832:14834 transaction failed 29201/-71, size 104-24 line 2921
[  439.019794] binder_alloc: 14832: binder_alloc_buf size -6468294964810874880 failed, no address space
[  439.019801] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  439.019819] binder: 14832:14834 transaction failed 29201/-28, size 0--6468294964810874880 line 3136
[  439.022755] binder_alloc: binder_alloc_mmap_handler: 14832 20001000-20004000 already mapped failed -16
[  439.037245] binder: 14832:14835 got reply transaction with no transaction stack
[  439.037254] binder: 14832:14835 transaction failed 29201/-71, size 104-24 line 2921
[  439.037361] binder: BINDER_SET_CONTEXT_MGR already set
[  439.037369] binder: 14832:14835 ioctl 40046207 0 returned -16
[  439.037761] binder: undelivered TRANSACTION_ERROR: 29201
[  439.037798] binder: undelivered TRANSACTION_ERROR: 29201
[  439.037849] binder: undelivered TRANSACTION_ERROR: 29201
[  439.097001] binder: BINDER_SET_CONTEXT_MGR already set
[  439.097010] binder: 14837:14839 ioctl 40046207 0 returned -16
[  439.098005] binder: send failed reply for transaction 283 to 14837:14838
[  439.102543] binder: undelivered TRANSACTION_COMPLETE
[  439.102550] binder: undelivered TRANSACTION_ERROR: 29189
[  439.129763] device lo entered promiscuous mode
[  439.134312] device lo left promiscuous mode
[  439.203214] binder_alloc: 14845: binder_alloc_buf failed to map page at 20001000 in userspace
[  439.203246] binder: 14845:14846 transaction failed 29201/-12, size 0-0 line 3136
[  439.209128] binder_alloc: binder_alloc_mmap_handler: 14845 20001000-20004000 already mapped failed -16
[  439.214049] binder: BINDER_SET_CONTEXT_MGR already set
[  439.214058] binder: 14845:14847 ioctl 40046207 0 returned -16
[  439.214181] binder_alloc: 14845: binder_alloc_buf, no vma
[  439.214199] binder: 14845:14846 transaction failed 29189/-3, size 0-0 line 3136
[  439.214478] binder: undelivered TRANSACTION_ERROR: 29201
[  439.214840] binder: undelivered TRANSACTION_ERROR: 29189
[  439.373202] device lo entered promiscuous mode
[  439.376924] device lo left promiscuous mode
[  439.715323] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  439.728860] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  439.783756] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  439.797616] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  439.852563] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  439.867170] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  439.881492] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  439.897387] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  440.484219] IPVS: Creating netns size=2536 id=105
[  440.615935] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  440.692284] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  440.698701] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  440.706107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  440.838654] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  440.856766] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  440.947398] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  440.966228] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  441.055027] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  441.076661] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  441.094738] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  441.101779] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  441.109928] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  441.121095] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  441.128061] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  441.135808] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
03:36:49 executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140), 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:49 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r1, 0x8912, &(0x7f0000000180)="025c3f0a00145f8f764070")
r2 = socket$inet(0x10, 0x3, 0x0)
sendmsg(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000880)="24000000280007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000001100ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0)
r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:49 executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140), 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

[  441.207675] device lo entered promiscuous mode
[  441.214178] device lo left promiscuous mode
03:36:49 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:49 executing program 2:
perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, @perf_config_ext={0x3, 0x10000}, 0x0, 0x2000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/checkreqprot\x00', 0x80000, 0x0)
getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000100), &(0x7f0000000140)=0x30)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:36:49 executing program 3:
mlockall(0x1)
r0 = syz_open_dev$loop(&(0x7f0000000500)='/dev/loop#\x00', 0x7, 0x12040)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = creat(&(0x7f0000000280)='./file0\x00', 0x1)
write$P9_RWALK(r3, &(0x7f00000002c0)={0x57, 0x6f, 0x2, {0x6, [{0x1a, 0x1}, {0x8, 0x0, 0x6}, {0x80, 0x4, 0x3}, {0x0, 0x3}, {0x1, 0x1, 0x3}, {0x38, 0x2, 0x6}]}}, 0x57)
r4 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r5 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="3e8dc656f89085660000000000000000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000180)={'veth0_to_bridge\x00', 0x8000})
ioctl$BLKBSZSET(r6, 0x40081271, &(0x7f0000000380)=0x7ff)
setsockopt$inet6_tcp_TLS_TX(r5, 0x6, 0x1, &(0x7f0000000340), 0x4)
r7 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000480)='/dev/pktcdvd/control\x00', 0x82040, 0x0)
ioctl$LOOP_SET_FD(r0, 0x4c00, r7)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r6, 0x404c534a, &(0x7f0000000400)={0x2, 0x3, 0x7})

03:36:49 executing program 5:
r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000040)=<r2=>0x0)
ptrace(0x421f, r2)
r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0)
getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000001c0)={<r4=>0x0, @dev, @broadcast}, &(0x7f0000000240)=0xc)
ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000280)={'team0\x00', r4})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
writev(r3, &(0x7f0000000140)=[{&(0x7f0000000080)="1ec1cf1de217086cd8abaa7a0b68660cef6ceaf217d7b638acf141149636e5c3d593ec1ae121063d870e5cb2", 0x2c}, {&(0x7f00000002c0)="2bf5b378b511168ed0608cd70d1109ae840741848871e43cca9153c8bd61f3f397914d10b1f328cc26e7b48f4facd7bb8907a15bf31f302baf7b7c632fc7a4a0fb344b9b11bfc5ed698dcde14fc6ebc8e8e672b082efad040b88d6ec2c4fab93b10a0975bc74bfaf5b45dec520bbda461f434f131216c22fbc224ffc7bb0e58f9ce3eba27f94bc3faba7956e6bc97fcdfb6896243deae62f4cd4107993fa540c9b2fffb2db9f20ea894a64382a426fc1741b090450a84b6a5f43cf446ea5252607585466185d577b80ca82", 0xcb}], 0x2)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

[  441.260572] netlink: 8 bytes leftover after parsing attributes in process `syz-executor7'.
[  441.299476] device lo left promiscuous mode
03:36:49 executing program 6:
syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r0, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0)
sendfile(r0, r0, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  441.306697] binder_alloc: 15338: binder_alloc_buf failed to map page at 20001000 in userspace
[  441.306729] binder: 15338:15339 transaction failed 29201/-12, size 0-0 line 3136
[  441.307167] binder: 15341:15343 ioctl c0306201 20000440 returned -14
03:36:49 executing program 6:
syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r0, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0)
sendfile(r0, r0, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  441.404406] binder_alloc: binder_alloc_mmap_handler: 15338 20001000-20004000 already mapped failed -16
[  441.404737] binder: BINDER_SET_CONTEXT_MGR already set
[  441.404745] binder: 15338:15359 ioctl 40046207 0 returned -16
[  441.405537] binder: undelivered TRANSACTION_ERROR: 29201
03:36:49 executing program 6:
syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r0, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0)
sendfile(r0, r0, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:49 executing program 6:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:36:49 executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

[  441.660698] binder: 15369:15370 ioctl c0306201 20000440 returned -14
03:36:49 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000100000000000000f6247d6e3a05ca670829570000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

[  441.785891] netlink: 8 bytes leftover after parsing attributes in process `syz-executor7'.
[  441.797030] device lo entered promiscuous mode
[  441.808853] device lo left promiscuous mode
03:36:49 executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

[  441.846676] binder_alloc: 15377: binder_alloc_buf size 5620043502373727872 failed, no address space
[  441.885628] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  441.917152] binder: 15377:15379 transaction failed 29201/-28, size 2663316229636227072-2956727272737500797 line 3136
[  441.973517] binder_alloc: binder_alloc_mmap_handler: 15377 20001000-20004000 already mapped failed -16
[  441.997863] binder: BINDER_SET_CONTEXT_MGR already set
[  442.009276] binder: 15377:15386 ioctl 40046207 0 returned -16
[  442.025328] binder: undelivered TRANSACTION_ERROR: 29201
[  442.093771] device lo entered promiscuous mode
[  442.116952] device lo left promiscuous mode
[  442.928125] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  442.962356] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  442.968483] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  442.975999] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:36:51 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db10", 0x2)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:51 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pktcdvd/control\x00', 0x4001, 0x0)
getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000000c0)={0x0, <r3=>0x0}, &(0x7f0000000140)=0xc)
fstat(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0})
getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000200)={0x0, <r5=>0x0}, &(0x7f0000000240)=0xc)
write$P9_RSTATu(r2, &(0x7f0000000380)={0x8f, 0x7d, 0x2, {{0x0, 0x6d, 0x20, 0x7fffffff, {0x40, 0x3, 0x3}, 0x4000000, 0x5, 0x2, 0x4, 0xd, '/dev/binder#\x00', 0x1, '*', 0x21, 'em0eth0\'cpuset%*posix_acl_access\x00', 0xb, '*[wlan1self'}, 0xd, '/dev/binder#\x00', r3, r4, r5}}, 0x8f)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x76, 0x0, &(0x7f0000000000)="9d1d071d4575e0f77b5ac5220d4f17668a181c277a0f6e2cb9f1a9f64493b7665011b1043c7bd2e940e03726476913c4b5faa1b1db5382dca4cc86d42174623a2745a80a312fe23b113991fc38fdfef5d592c90217dc63653f58eb2a38fe3ab65ce4e88289518ca7f10dbf7844579567edfa26e19962"})

03:36:51 executing program 1:
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:51 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x400000000000003, 0xffffffffffffffff)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

[  444.018563] binder_alloc: 15654: binder_alloc_buf failed to map page at 20001000 in userspace
[  444.027582] binder: 15654:15655 transaction failed 29201/-12, size 0-0 line 3136
[  444.037533] binder: BINDER_SET_CONTEXT_MGR already set
[  444.042985] binder_alloc: 15654: binder_alloc_buf, no vma
[  444.049478] binder: 15654:15655 ioctl 40046207 0 returned -16
[  444.055511] binder: 15654:15657 transaction failed 29189/-3, size 0-0 line 3136
[  444.469396] IPVS: Creating netns size=2536 id=106
[  444.646133] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  444.661456] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  444.760940] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  444.774591] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  444.833314] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  444.849340] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  444.862938] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  444.913698] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  446.130485] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  446.166238] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  446.172357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  446.179834] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:36:55 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
clock_gettime(0x0, &(0x7f0000000180)={<r1=>0x0, <r2=>0x0})
utimes(&(0x7f0000000040)='./file0\x00', &(0x7f0000000240)={{r1, r2/1000+30000}, {0x0, 0x7530}})
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:36:55 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
pipe(&(0x7f0000000000)={<r1=>0xffffffffffffffff})
setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f0000000040)={'mangle\x00', 0x3, [{}, {}, {}]}, 0x58)

03:36:55 executing program 6:
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:55 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:55 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = mmap$binder(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x1000002, 0x10, r0, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={r1})
r2 = getpid()
fcntl$lock(r0, 0x7, &(0x7f0000000000)={0x2, 0x1, 0xffffffffffffff71, 0x3, r2})
r3 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r3, &(0x7f0000000080)="020000000000884e910f2e6e070fdcd20000b0", 0x13)
mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4, 0x11, r3, 0x0)
sendfile(r3, r3, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:36:55 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:36:55 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
ioctl$SG_SET_DEBUG(r4, 0x227e, &(0x7f0000000200))

[  447.266712] device lo entered promiscuous mode
[  447.277877] device lo left promiscuous mode
[  447.326823] binder_alloc: 16041: binder_alloc_buf failed to map page at 20001000 in userspace
[  447.369906] binder: 16041:16042 transaction failed 29201/-12, size 0-0 line 3136
[  447.406790] binder_alloc: binder_alloc_mmap_handler: 16041 20001000-20004000 already mapped failed -16
03:36:55 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00s@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

[  447.437231] binder: BINDER_SET_CONTEXT_MGR already set
[  447.454063] binder: 16041:16048 ioctl 40046207 0 returned -16
[  447.470393] binder: undelivered TRANSACTION_ERROR: 29201
[  447.514213] binder: 16053:16054 unknown command 1077965568
[  447.524565] binder: 16053:16054 ioctl c0306201 20000440 returned -22
[  447.545117] binder_alloc: binder_alloc_mmap_handler: 16053 20001000-20004000 already mapped failed -16
[  447.560645] binder: BINDER_SET_CONTEXT_MGR already set
03:36:55 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x2, 0x2009e, r0, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x4)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:36:55 executing program 5:
r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x7, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdaa2, 0x0, 0x2000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ftruncate(r0, 0x80000000)
syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x400fffffffd, 0x0)
r1 = socket$inet6(0xa, 0x4, 0x0)
accept4$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000140)=0x1c, 0x80000)
openat$urandom(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x41c440, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000080)={'\x00', 0x1a00})
ioctl$sock_inet_SIOCGIFPFLAGS(r2, 0x8935, &(0x7f00000001c0)={'bond_slave_1\x00'})
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0x3})

[  447.569899] device lo entered promiscuous mode
[  447.594940] binder: 16053:16055 ioctl 40046207 0 returned -16
03:36:55 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x9, 0x224000)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000640)=ANY=[@ANYBLOB="90000000000000000000000b000007000066ce656d316e6f246576656d31000000000000000000000000000000e7c80eed78c64fb894cac0954cb29f2c000000000000619fcd381e1089b3e84551f18c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc632d75736574636772007570246367726f7b9039826ed737ba1744b7677f577ef5f70f0749cd4aafdf426af865e8edaf3c449a0a8c28b67dd372da16e35e8bf752ff927c1a96b77d4b122638fd5e2fe4fc66a0536552f1cb546b9e6bcbdd9110358707ee9af9b56d1fdcb59ae92f1f8aa7140ae209811461826fb82e7607f97015bfc1614fecd69839e9372454e5fd3d14edf3c8ea06f04a634b9700000000000000000000000000000000"], 0x90)

[  447.659355] binder_alloc: 16059: binder_alloc_buf, no vma
[  447.671831] binder: 16059:16060 transaction failed 29189/-3, size 0-0 line 3136
[  447.696548] binder: BINDER_SET_CONTEXT_MGR already set
03:36:55 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
getsockopt$sock_buf(r1, 0x1, 0x1f, &(0x7f0000001240)=""/82, &(0x7f00000012c0)=0x52)
r2 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r4 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x4a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r5)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r2)

[  447.707536] binder: 16059:16067 ioctl 40046207 0 returned -16
03:36:55 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)={'team0\x00', <r3=>0x0})
setsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000040)={r3, @local, @broadcast}, 0xc)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

03:36:55 executing program 5:
r0 = add_key$user(&(0x7f0000000080)='user\x00', &(0x7f0000000140)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000240)="8b4a411e56694e9a27fc4c0b7a8ff5307686c899044b0528eb0d916d5ce4ac5ff523f007fa71b3e3b45bfd598fa85a2375b62fbb26c8698eebf77c108f5a9b934abe8f059d731613b69f5244179a7bf7fbe24fab9a9c96201dc149778e5559bc606656f0baee86f36aad45a9a25a0d9c34882adf62526ecd0a76d1f52c1cde7946b74e557a0383e85029ea68f9c810c552a05c09bb392ef20c5e014370171c86bb649ec01311b9370691a24c2e962756", 0xb0, 0xfffffffffffffff8)
keyctl$assume_authority(0x10, r0)
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={"6c6f00000000000000000000000200"})
ioctl$sock_SIOCADDDLCI(r1, 0x8980, &(0x7f0000000000)={'irlan0\x00', 0x5})

[  447.737795] binder: undelivered TRANSACTION_ERROR: 29189
[  447.755840] device lo left promiscuous mode
[  447.801977] binder: 16080:16083 ioctl 8933 20000000 returned -22
[  447.829658] binder_alloc: 16080: binder_alloc_buf failed to map page at 20001000 in userspace
[  447.839747] device lo entered promiscuous mode
[  447.840203] device lo left promiscuous mode
[  447.869061] binder: 16080:16083 transaction failed 29201/-12, size 0-0 line 3136
[  447.905404] binder_alloc: binder_alloc_mmap_handler: 16080 20001000-20004000 already mapped failed -16
[  447.916445] binder: 16080:16083 ioctl 8933 20000000 returned -22
[  447.922959] binder: BINDER_SET_CONTEXT_MGR already set
[  447.922968] binder: 16080:16089 ioctl 40046207 0 returned -16
[  447.928511] binder_alloc: 16080: binder_alloc_buf, no vma
[  447.928532] binder: 16080:16091 transaction failed 29189/-3, size 0-0 line 3136
[  447.928897] binder: undelivered TRANSACTION_ERROR: 29189
[  447.928960] binder: undelivered TRANSACTION_ERROR: 29201
[  448.095984] device lo entered promiscuous mode
[  448.103005] device lo left promiscuous mode
[  448.960196] IPVS: Creating netns size=2536 id=107
[  448.994504] IPVS: Creating netns size=2536 id=108
[  449.022593] IPVS: Creating netns size=2536 id=109
[  449.060766] IPVS: Creating netns size=2536 id=110
[  449.927099] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  449.952315] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  450.038428] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  450.054466] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  450.090659] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  450.110121] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  450.159954] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  450.208874] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  450.223912] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  450.244357] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  450.297189] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  450.326566] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  450.371955] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  450.427516] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  450.453010] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  450.483527] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  450.503932] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  450.517432] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  450.528090] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  450.554251] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  450.564855] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  450.573494] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  450.587806] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  450.603461] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  450.614461] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  450.626791] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  450.643560] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  450.682373] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  450.697637] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  450.731358] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  450.757355] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  450.770507] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  450.796809] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  450.808493] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  450.850620] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready
[  450.858529] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[  450.869514] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  450.879723] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready
[  450.887967] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[  450.896250] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  451.774990] IPVS: Creating netns size=2536 id=111
[  452.493954] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  452.540500] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  452.741607] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  452.781423] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  452.990660] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  453.031690] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  453.083236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  453.117972] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  453.198607] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  453.323015] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  453.341108] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  453.348484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  453.355546] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  453.365542] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  453.465521] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  453.475259] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  453.482358] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  453.490762] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  453.497908] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  453.508650] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  453.522096] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  453.639434] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  453.657100] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  453.663804] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  454.938124] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  454.978903] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  454.985028] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  454.992513] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:37:02 executing program 7:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x181100, 0x0)
ioctl$BLKRRPART(r0, 0x125f, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0)
madvise(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

03:37:02 executing program 5:
r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0)
r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x800, 0x0)
ioctl$IOC_PR_REGISTER(r1, 0x401870c8, &(0x7f0000000040)={0x3, 0x6})
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'lo\x00@\x00', 0x101})

03:37:02 executing program 1:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
pipe(&(0x7f0000000000)={<r1=>0xffffffffffffffff})
setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f0000000040)={'mangle\x00', 0x3, [{}, {}, {}]}, 0x58)

03:37:02 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b000000e5ff"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

[  455.153826] binder_alloc: 17936: binder_alloc_buf size 274878185472 failed, no address space
[  455.169973] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288)
[  455.183296] device lo entered promiscuous mode
[  455.190254] device lo left promiscuous mode
[  455.222291] binder: 17936:17939 transaction failed 29201/-28, size 137439084544-137439100928 line 3136
03:37:03 executing program 6:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
pipe(&(0x7f0000000000)={<r1=>0xffffffffffffffff})
setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f0000000040)={'mangle\x00', 0x3, [{}, {}, {}]}, 0x58)

03:37:03 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x5, 0x4)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'\x00', 0x1000})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

[  455.245870] binder_alloc: binder_alloc_mmap_handler: 17936 20001000-20004000 already mapped failed -16
[  455.258989] binder: BINDER_SET_CONTEXT_MGR already set
[  455.264281] binder: 17936:17955 ioctl 40046207 0 returned -16
[  455.279933] binder_alloc: 17936: binder_alloc_buf, no vma
[  455.280305] binder: undelivered TRANSACTION_ERROR: 29201
[  455.293356] binder: 17936:17939 transaction failed 29189/-3, size 137439084544-137439100928 line 3136
[  455.317560] binder: undelivered TRANSACTION_ERROR: 29189
[  455.320770] device lo entered promiscuous mode
[  455.323203] device lo left promiscuous mode
03:37:03 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
recvfrom(r1, &(0x7f0000000940)=""/202, 0xca, 0x800040, &(0x7f0000000140)=@vsock={0x28, 0x0, 0x2711, @my=0x0}, 0x80)
ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000300)=<r2=>0x0)
ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000580)=r2)
r3 = mmap$binder(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1, 0x88010, r0, 0x0)
r4 = mmap$binder(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3000004, 0x81ea932ae0b231d, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000240)={<r5=>0x0})
r6 = mmap$binder(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x8, 0x140110, r0, 0x50)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000400)={0xe0, 0x0, &(0x7f0000000480)=[@register_looper, @reply={0x40406301, {0x4, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x18, 0x8, &(0x7f00000001c0)=[@flat={0x77622a85, 0x1, r3, 0x3}], &(0x7f0000000200)=[0x38]}}, @request_death={0x400c630e, 0x2, 0x3}, @register_looper, @free_buffer={0x40086303, r4}, @increfs_done={0x40106308, r5, 0x1}, @transaction={0x40406300, {0x3, 0x0, 0x2, 0x0, 0x10, 0x0, 0x0, 0x0, 0x10, &(0x7f0000000300), &(0x7f0000000340)=[0x78, 0x0]}}, @acquire_done={0x40106309, r6}, @exit_looper, @decrefs={0x40046307, 0x3}], 0x7a, 0x0, &(0x7f0000000380)="32a8da63721ebe4d90b52ab1319d47006af947a6270594552706b76ee0076e2677d1ee18e87e3cd3b97ca19a2c8100315386aeb80bf026e4504287067358b7ab3dbe6c80b4ff0c9f6d1c8c0179607e01a08358cbffb5fc94f44237ccfdf1854dd8771f52b8c27b8e6c5d68fbcc1db6aa80eb2a2abea190222d91"})
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
pwritev(r1, &(0x7f0000000800)=[{&(0x7f00000005c0)="cf25bcb6f62eb97438dce2b5ad621e561b77541eb4ffbff560bb1e224e8142bda847ab029c3cba353ac71992de5a55c371ac660df8c7089e03aa912a03e91a20d1e0ff421d83cb16d9c2ab810279edfba538b5bc46f2ece89087ad6a2ad75b89b31dea35e4f4dd6003b2548ba4900347a4fc373d1f683fc3f0150192c7e89bd91d470c10c9389f703d3bc7577e9062d2f1517c95ecdfb100cf71977ad7c18b80a9983bd62c86de14351647f784fdbc9647b15b3df55f1e94f8c960de5b272595b5ca9d445ebdaf1d6aa7279e3704a87ec66790ed", 0xd4}, {&(0x7f00000006c0)="300a33e1bd2943e0686ad39fffb043c96e21928caddbecb05eb4ebcd62f3e27cee25a4b62cb67b6ae001", 0x2a}, {&(0x7f0000000700)="7165fec5a8487081bc81d11094415c8533dd49b75c135c810abf4e76ebd37ae413b111825ec2801b52312a16d0868a9307ef32f069abeb7ff936b7d1513fa1b5d70ebce64307922e30cbe7fe8634ae495955549aac16e13389e982de0d38f48b0f9909bb4faa7020324d59bb067c2431f820a66bab44f5b25af21dbd65bf29112fdc3b39639788e49a3f64dbc6ee408516fecbb1a35a0ce26bedfe968c33e01a7c4677958c5c50e850684b126e90f3c1126e7f07e95133f363d7adaeaeed348fb2c5363c06459a8c1f87e51396069d24f015154cd6", 0xd5}], 0x3, 0x0)
write$binfmt_script(r0, &(0x7f0000000080)={'#! ', './file0', [{}, {0x20, '/dev/binder#\x00'}], 0xa, "570de78105a28b5e2d80d2555a6aff4f840e0fe5f3c4e9364ca03529af48a9c498c9b1af658f4381cf9b79aec4cf33955d61a1e60b0e45384d7281d76b8f1e28a343d76642190f9e287ffc97cf3fc8348196c77d1cb8646e67eb92326c95d7c239637e1de3fe537a40a79c22"}, 0x86)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$TIOCMBIC(r1, 0x5417, &(0x7f0000000040)=0x1)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:37:03 executing program 1:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
pipe(&(0x7f0000000000)={<r1=>0xffffffffffffffff})
setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f0000000040)={'mangle\x00', 0x3, [{}, {}, {}]}, 0x58)

03:37:03 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
write$P9_RCREATE(r0, &(0x7f0000000040)={0x18, 0x73, 0x2, {{0x1, 0x2, 0x6}, 0x9}}, 0x18)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:37:03 executing program 6:
r0 = socket(0x2000000011, 0x3, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x50400, 0x0)
ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f00000000c0)='veth0_to_team\x00')
r2 = userfaultfd(0x800)
r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/schedule_icmp\x00', 0x2, 0x0)
ioctl$INOTIFY_IOC_SETNEXTWD(r3, 0x40044900, 0x9)
ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1})
ioctl$FICLONERANGE(0xffffffffffffffff, 0x4020940d, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x81})
sendto$inet6(r0, &(0x7f0000000040), 0xfe69, 0x0, &(0x7f0000000140)={0xa, 0x8100, 0x1, @ipv4={[], [], @multicast2}}, 0x1c)
getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000001c0)={{{@in=@multicast2, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in=@loopback}, 0x0, @in6}}, &(0x7f00000002c0)=0xe8)
syz_open_pts(r3, 0x600000)
ioctl$sock_ifreq(r1, 0x89ff, &(0x7f0000000300)={'bridge0\x00', @ifru_addrs=@hci={0x1f, r4}})

03:37:03 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
splice(r0, &(0x7f0000000000), r1, &(0x7f0000000040), 0x0, 0x8)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:37:03 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0x80800)
setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000180)=@req3={0x5, 0xfffffffffffff801, 0x8, 0xffffffff, 0xfff, 0xffff, 0xffff}, 0x1c)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:37:03 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}, 0x1, 0x0, 0x0, 0x1}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:37:03 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

[  455.474192] binder: 18002:18003 ioctl c0306201 20000440 returned -14
[  455.482372] binder: 18002:18004 ioctl c018620b 20000040 returned -14
[  455.490238] binder: 18002:18003 ioctl c0306201 20000440 returned -14
03:37:03 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = dup(r1)
ioctl$EVIOCSREP(r2, 0x40084503, &(0x7f0000000000)=[0x2, 0xa0d8])
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063400012300000000000000000000000000d090000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

03:37:03 executing program 6:
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x0)
mremap(&(0x7f00003f6000/0xf000)=nil, 0xf000, 0x4000, 0x0, &(0x7f000028d000/0x4000)=nil)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
write(r1, &(0x7f00000001c0), 0xfffffef3)
openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/validatetrans\x00', 0x1, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3)

03:37:03 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0xcc, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="2ca3a421d23f0d717aafee2c397a28cde09db62d5c8fe6d5bd5cc9d15a43ed58c97c8b8512b7dd02c4ca583b54b57b447b0652f1749ad85ac0a5826caa3e5b49979cca9d9b83a7e3f2cd21db19dd5cf7fd2c97a2e1eb5ed100f4788471aecf63dbbc9468b61e559c3e2ac112c9647934973e0163ce28440888cbee46c246c26ab8b68d0a1cdec87066f956dd0abda17a77874284c523879d2c49768582cef12d498c52f33efd9bb47e84a5f8fae92272c7d430ac617e3dceedd6fe30ac632c58d16b77666e0616dc41d9cdc2ffd46da8e3d2", @ANYRES64=r1, @ANYBLOB="ba9607aba465ad3b45496947de6031a14e37bf78400235fc2115d67dbe670ba8bab03bc655e305bcdb1efa505e1444cb21f418400ad1c7e461ddfc0772f14819f2c6f0d45e751fce342dbf14d21578e6be864d62c4", @ANYRES32=r1, @ANYRES32=r0, @ANYRESHEX=r0], 0xfffffffffffffced, 0x0, &(0x7f0000000300)="1112cd22ee8be1989862ef556d135583dcd8901bc60a3e4ba1c0ee4abfaa08a7ad51c8408e743dfdfbbac47ee2a7cdec3223c32f8ff3a608b01950fe7b4d6ad3fade76eb391805a4b444799cd40a01af531def3267c90d9a6502fcfa2539dad5211bf6c91cd147679534b71225092c02265286a0636fdae6312e9bd27911e73612b9e996530e03fe8a94e04e01b3159bb5c3"})

[  455.528962] device lo entered promiscuous mode
[  455.546716] binder_alloc: 18008: binder_alloc_buf failed to map page at 20001000 in userspace
[  455.546748] binder: 18008:18020 transaction failed 29201/-12, size 0-0 line 3136
03:37:03 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
r2 = socket$packet(0x11, 0x3, 0x300)
finit_module(r2, &(0x7f0000000040)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x4, 0x1010, r0, 0x2)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:37:03 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000040)=<r2=>0x0)
tkill(r2, 0x3b)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
umount2(&(0x7f0000000000)='./file0\x00', 0x1)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404000007ebb293d04af5c000000000000000000000029503d000000003c1a0515d44808eadbdeff44b6000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)})

[  455.548340] binder_alloc: binder_alloc_mmap_handler: 18008 20001000-20004000 already mapped failed -16
[  455.548493] binder: BINDER_SET_CONTEXT_MGR already set
03:37:03 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
getsockopt$EBT_SO_GET_INIT_ENTRIES(r1, 0x0, 0x83, &(0x7f00000001c0)={'filter\x00', 0x0, 0x3, 0xa7, [], 0x9, &(0x7f0000000040)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000100)=""/167}, &(0x7f0000000240)=0x78)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:37:03 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

[  455.548509] binder: 18008:18020 ioctl 40046207 0 returned -16
[  455.548680] binder_alloc: 18008: binder_alloc_buf, no vma
[  455.548697] binder: 18008:18024 transaction failed 29189/-3, size 0-0 line 3136
03:37:03 executing program 4:
r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/net/pfkey\x00', 0x2, 0x0)
ioctl$PERF_EVENT_IOC_ID(r0, 0x80082407, &(0x7f0000000300))
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
r2 = open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r1, &(0x7f0000002000), 0x1000)
read$FUSE(r1, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r1, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
ioctl$EVIOCSREP(r2, 0x40084503, &(0x7f0000000040)=[0x7ffe, 0x80000001])
write$FUSE_DIRENT(r2, &(0x7f0000000240)=ANY=[@ANYRESDEC=r3], 0x14)
write$FUSE_IOCTL(r1, &(0x7f0000000180)={0x20, 0xffffffffffffffda, 0x3, {0x2, 0x0, 0x4, 0x80}}, 0x20)

03:37:03 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0)
ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f0000000040))
ioctl$IOC_PR_REGISTER(r1, 0x401870c8, &(0x7f0000000100)={0x2, 0x5})
r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
getsockopt$inet_int(r2, 0x0, 0x16, &(0x7f00000001c0), &(0x7f0000000200)=0x4)
ioctl$BLKRAGET(r2, 0x1263, &(0x7f0000000140))
write(r2, &(0x7f0000000000)="a85883156f794c05e0b0", 0x384)
ioctl$BLKROTATIONAL(r0, 0x127e, &(0x7f0000000080))
syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00')
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0)
ioctl$sock_inet_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000480)={'veth0_to_bond\x00', {0x2, 0x4e22, @rand_addr=0xfff}})
sendfile(r2, r2, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, &(0x7f00000003c0)})

[  455.548989] binder: undelivered TRANSACTION_ERROR: 29189
[  455.549049] binder: undelivered TRANSACTION_ERROR: 29201
[  455.575985] binder: 18025:18028 ioctl 40084503 20000000 returned -22
[  455.576594] binder: 18025:18028 unknown command 4219648
[  455.576602] binder: 18025:18028 ioctl c0306201 20000440 returned -22
[  455.577654] binder: 18025:18028 ioctl 40084503 20000000 returned -22
[  455.577897] binder: BINDER_SET_CONTEXT_MGR already set
[  455.577905] binder: 18025:18030 ioctl 40046207 0 returned -16
[  455.582322] binder: 18006:18017 ioctl c0306201 20000440 returned -14
[  455.588872] binder: 18006:18032 ioctl c0306201 20000440 returned -14
[  455.624826] binder: 18039:18041 unknown command 564437804
[  455.624834] binder: 18039:18041 ioctl c0306201 200002c0 returned -22
[  455.630577] binder_alloc: binder_alloc_mmap_handler: 18039 20001000-20004000 already mapped failed -16
[  455.632100] binder: BINDER_SET_CONTEXT_MGR already set
[  455.632108] binder: 18039:18045 ioctl 40046207 0 returned -16
[  455.632199] binder: 18039:18045 unknown command 564437804
[  455.632207] binder: 18039:18045 ioctl c0306201 200002c0 returned -22
[  455.669610] binder: 18050:18053 got transaction to invalid handle
[  455.669620] binder: 18050:18053 transaction failed 29201/-22, size -5312840327752972216-0 line 3013
[  455.678259] binder: BINDER_SET_CONTEXT_MGR already set
[  455.678268] binder: 18050:18055 ioctl 40046207 0 returned -16
[  455.681004] binder: 18050:18058 got transaction to invalid handle
[  455.681018] binder: 18050:18058 transaction failed 29201/-22, size -5312840327752972216-0 line 3013
[  455.681398] binder: undelivered TRANSACTION_ERROR: 29201
[  455.681463] binder: undelivered TRANSACTION_ERROR: 29201
[  455.728194] binder: 18056:18059 ioctl c0306201 20000440 returned -14
[  455.729368] binder: 18056:18064 ioctl c0306201 20000440 returned -14
[  455.731892] binder: BINDER_SET_CONTEXT_MGR already set
[  455.731900] binder: 18061:18063 ioctl 40046207 0 returned -16
[  455.732322] binder: 18061:18063 got transaction to context manager from process owning it
[  455.732335] binder: 18061:18063 transaction failed 29201/-22, size 0-0 line 3004
[  455.732990] binder: BINDER_SET_CONTEXT_MGR already set
[  455.732998] binder: 18061:18063 ioctl 40046207 0 returned -16
[  455.738266] binder: BINDER_SET_CONTEXT_MGR already set
[  455.738274] binder: 18061:18065 ioctl 40046207 0 returned -16
[  455.750320] binder_alloc: 18061: binder_alloc_buf, no vma
[  455.750342] binder: 18061:18066 transaction failed 29189/-3, size 0-0 line 3136
[  455.750631] binder: undelivered TRANSACTION_ERROR: 29189
[  455.750687] binder: undelivered TRANSACTION_ERROR: 29201
[  455.760845] binder: 18068:18069 ioctl 127e 20000080 returned -22
[  455.767726] binder: 18068:18069 ioctl c0306201 20000440 returned -14
[  455.788600] binder: 18068:18071 ioctl 127e 20000080 returned -22
[  455.789855] binder: 18068:18071 ioctl c0306201 20000440 returned -14
[  456.060976] device lo entered promiscuous mode
03:37:03 executing program 1:
r0 = fcntl$getown(0xffffffffffffffff, 0x9)
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r1, 0x100000, &(0x7f0000000280)="0a951200000000b7de50707697a297457cac41cc52ecf43ef9cfcc41f8c7fdd9fad78e5f3e8ddfe216acc7a6181d5ae2b7b809eb88815bd1778684cadf8d17487ab14edfc8aa1140a8585bae22bfebdda168cb9dc4905ae50ca6cfbf9814cc8e9f688a2a4ec96889f8363d58525db44f4e1147fbacad43bc53029d8985094c62a2ba451f517dfd042daf630ed3dc7113255b7a5afde32d0900000000000000d2ada4835b4f520366797d05e8ba77f3be0245ccf65a0e8d20dd4089ceaaf31f")
unlink(&(0x7f0000000040)='./file0\x00')
perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
preadv(r1, &(0x7f0000000440)=[{&(0x7f0000000340)=""/202, 0xca}, {&(0x7f0000000540)=""/242, 0xf2}, {&(0x7f00000001c0)=""/94, 0x5e}, {&(0x7f0000000640)=""/251, 0xfb}, {&(0x7f0000000740)=""/172, 0xac}], 0x5, 0x0)
syz_mount_image$f2fs(&(0x7f0000000180)='f2fs\x00', &(0x7f0000000240)='./file0\x00', 0x0, 0x0, &(0x7f00000008c0), 0x1003, &(0x7f0000000540)=ANY=[])
syz_mount_image$btrfs(&(0x7f0000000040)='btrfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000140)=ANY=[])
perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$ASHMEM_GET_PIN_STATUS(0xffffffffffffffff, 0x7709, 0x0)
r2 = syz_open_dev$sndseq(&(0x7f0000000080)='/dev/snd/seq\x00', 0x0, 0x0)
syz_open_procfs(r0, &(0x7f00000000c0)='fd/4\x00')
r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f000085dff0)='/dev/sequencer2\x00', 0x10000080002, 0x0)
dup2(r2, r3)

[  456.084223] device lo left promiscuous mode
[  456.090527] device lo left promiscuous mode
[  456.183746] device lo entered promiscuous mode
[  456.191109] device lo left promiscuous mode
03:37:04 executing program 5:
r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vga_arbiter\x00', 0x200000, 0x0)
epoll_wait(r1, &(0x7f0000000240)=[{}, {}], 0x2, 0x200)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000000)=[{0xe, 0x9}, {0x4, 0x3f}, {0x4, 0x1ffc}], 0x3)
fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000040))
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
r3 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x84002, 0x88)
mkdirat$cgroup(r1, &(0x7f0000000140)='syz0\x00', 0x1ff)
write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000280)=ANY=[@ANYBLOB="31000000030000ff000027000000000000007976626f7890ae7875e7d06e657430776c0000000000000000000000000000a88ec15078cc845e57982d890d9ffaac807344333f99c555d961d494bde04467eac1c76ad39503391ca2bd34cd2a0a80f351c2ead14f517e04f49fa539fa591ad3cdac0ee4ff46605bd7192446324caeecab1e29f970efe3b6e40f8ba621230e441caba3b3bc11dfc494cba31ace3e3e9d50ebf8b67dbf2d7cd6f65ed97b22c5ce6c81479b52f2ee221689c347548b39ac32c4176d8d68bd86342bb6fa96423744493dd0f1e1a8c1046ef5803cb55894b6481d425c60a5b84b144ca5c093786194746132b886dbbe4678349ff80f457f0b0ef108"], 0x31)

03:37:04 executing program 7:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0)
sched_yield()
madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1)
ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)})

03:37:04 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r1, 0xc0505405, &(0x7f0000000040)={{0x1, 0x0, 0xd1, 0x1, 0x1}, 0x6, 0x1, 0xffffffff00000001})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})
ioctl$TIOCLINUX4(r1, 0x541c, &(0x7f0000000140))

03:37:04 executing program 6:
madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x0)
mremap(&(0x7f00003f6000/0xf000)=nil, 0xf000, 0x4000, 0x0, &(0x7f000028d000/0x4000)=nil)
pipe(&(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
write(r1, &(0x7f00000001c0), 0xfffffef3)
openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/validatetrans\x00', 0x1, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3)

03:37:04 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:37:04 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
openat$md(0xffffffffffffff9c, &(0x7f0000000200)='/dev/md0\x00', 0x200800, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="030000000000000008001b0000000000bf04230ce2735b1c67b3268a8d08359832813e60c63ce482d7841e26c9aead05319ef386f1a617d31c764c2485d37b26a58f1f1518aae08889f00542df5773860e8cbeb7d38c3c573d2e293d21d32b2848f2b93be272fd2d10441da651cf0b85ff1df6bf1f14e737a09ecd5dadf024362b80ae617bc0ca8ed93ad1e0b823b70324a92b2ea2f8dde13d960ad04d6f27cf14305a81"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = gettid()
r5 = syz_open_procfs(r4, &(0x7f0000000280)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r5)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)
ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000180)={&(0x7f0000ffd000/0x1000)=nil, 0x1000})

03:37:04 executing program 1:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0)
write$P9_RCREATE(r0, &(0x7f0000000040)={0x18, 0x73, 0x2, {{0x1, 0x2, 0x6}, 0x9}}, 0x18)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

[  456.308427] binder_alloc: 18100: binder_alloc_buf failed to map page at 20001000 in userspace
[  456.334392] binder: 18100:18103 transaction failed 29201/-12, size 0-0 line 3136
[  456.345478] binder_alloc: binder_alloc_mmap_handler: 18100 20001000-20004000 already mapped failed -16
03:37:04 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
ioctl$IOC_PR_REGISTER(r1, 0x401870c8, &(0x7f00000000c0)={0xffffffffffffffff, 0xff})
sendfile(r1, r0, &(0x7f0000000000), 0x9d6b)
write(r1, &(0x7f0000000040)="a85883156f794c05e0b0", 0xa)
openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x84000, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

[  456.364428] binder: 18104:18116 ioctl c0306201 20000440 returned -14
[  456.375673] binder: 18104:18116 ioctl c0306201 20000440 returned -14
[  456.428076] binder: BINDER_SET_CONTEXT_MGR already set
[  456.433585] binder_alloc: 18100: binder_alloc_buf, no vma
[  456.439706] binder: 18100:18103 ioctl 40046207 0 returned -16
03:37:04 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
eventfd(0x40)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

[  456.452278] binder: 18121:18123 ioctl c0306201 20000440 returned -14
[  456.456212] device lo entered promiscuous mode
[  456.458718] device lo entered promiscuous mode
[  456.458959] binder: 18121:18127 ioctl c0306201 20000440 returned -14
03:37:04 executing program 2:
r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x400a00, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r2, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0)
dup2(r2, r0)
sendfile(r2, r1, &(0x7f0000317000), 0x5)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

[  456.466465] device lo left promiscuous mode
[  456.476989] binder: undelivered TRANSACTION_ERROR: 29201
[  456.552400] binder: 18100:18114 transaction failed 29189/-3, size 0-0 line 3136
[  456.561886] binder: 18130:18131 ioctl c0306201 20000440 returned -14
03:37:04 executing program 7:
r0 = socket$l2tp(0x18, 0x1, 0x1)
r1 = fcntl$dupfd(r0, 0xc8668d7be40d381, r0)
write$FUSE_INIT(r1, &(0x7f0000000080)={0x50, 0x0, 0x6, {0x7, 0x1b, 0x8c, 0x0, 0x0, 0x6, 0x1, 0x5}}, 0x50)
connect$l2tp(r0, &(0x7f0000000040)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x0, 0x0, 0x4, {0xa, 0x0, 0x0, @mcast2}}}, 0x32)
getsockopt$packet_buf(r0, 0x111, 0x5, &(0x7f0000000140)=""/162, &(0x7f0000000000)=0xfffffffffffffca3)

[  456.567544] binder: 18130:18131 ioctl c0306201 20000440 returned -14
[  456.611509] binder: undelivered TRANSACTION_ERROR: 29189
[  456.627619] binder: 18135:18136 ioctl c0306201 20000440 returned -14
03:37:04 executing program 6:
syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000140)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000080)=ANY=[])
r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0)
fchdir(r0)
r1 = open(&(0x7f0000000280)='./bus\x00', 0x141042, 0x0)
fcntl$setstatus(r1, 0x4, 0x6100)
sendfile(r1, r1, &(0x7f00000000c0), 0x8080fffffffe)
openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0)

03:37:04 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000040)={<r1=>0xffffffffffffffff})
seccomp(0x0, 0x0, &(0x7f0000000280)={0x5, &(0x7f0000000240)=[{0x7fff, 0xed, 0x8000, 0xfffffffffffffffa}, {0x2, 0x0, 0x81, 0x6c}, {0x2, 0x8, 0x87, 0x6}, {0x101, 0x200, 0xdfa, 0x9}, {0x9, 0x8, 0xf3}]})
setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000180)=0x10, 0x4)
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:37:04 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000140)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x1)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BLKTRACESTART(r1, 0x1274, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:37:04 executing program 7:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @remote}, 0xb3)
sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10)
fgetxattr(r0, &(0x7f0000000000)=@known='com.apple.system.Security\x00', &(0x7f0000000100)=""/105, 0x69)
setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000015c0)="766574683100000000ffffffffffef00", 0xb)
sendto$inet(r0, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0), 0x6)

[  456.650565] binder: 18135:18139 ioctl c0306201 20000440 returned -14
03:37:04 executing program 6:
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$inet(0x2, 0x3, 0x2)
setsockopt$inet_int(r0, 0x0, 0xcf, &(0x7f0000000000), 0x4)
r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0)
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x800011, r1, 0x0)
mremap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil)
mremap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f000000a000/0x1000)=nil)

[  456.731911] device lo left promiscuous mode
[  456.739470] binder: 18149:18152 ioctl c0306201 20000440 returned -14
[  456.754306] device lo entered promiscuous mode
[  456.761841] device lo left promiscuous mode
[  456.792122] binder: 18149:18162 ioctl c0306201 20000440 returned -14
03:37:04 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030303030303034303030302c757365725f69643da6deec129c20341637c300d363fcf9e36729439941388e884e510001000000000000f2df184a8092381d476fd79318377aa63a5f1600fa42592beca06f10198c00066f7a9e41ddf5ac7524912d4e4d9cbff016b40c365daa7e98c1f4b12482ffdc3fc5ec5e5fa6ef2d42957334a845a156eab7732f17923d1f5239d1f11127ab7c4ae8cef6329a05bcd13fc0441d57b7ce000000000000000000009bec73a0a1e617431ec8213602e115ae2c83fa08d0ce18e33191d9117f4de3571358ba482fe35d23ac7f704877d46ad67e772f42baf75faa06de4042cf3c90b5e8ef85127a9038e2ccf754fcac444eb1672cd8bbbb0216c54a00511e2e805084f92bf724fbc98e162a3115ecac8b17b22147c41be4fa3e76718b9c0229eb094506aee5c0034dfea2b5a7ee0d51e0fc54dbed95a813578e9bc4afaf8215dfc1c6928c0500000000000000101a7eccafc7ee498d52696b392e1202", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="634a01a077992f470085153208c1cdb65c0a91bef74c33c01a56942e0f254a819309d30ac530aeceb903"])
read$FUSE(r1, &(0x7f00000030c0), 0x1000)
ioctl$int_in(r1, 0x5421, &(0x7f0000000a00)=0x3)
read$FUSE(r1, &(0x7f0000001000), 0x1000)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:37:04 executing program 1:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f760070")
capset(&(0x7f0000000080)={0x19980330}, &(0x7f00000000c0))
setgid(0x0)
r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x40000, 0x0)
ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000000))

03:37:04 executing program 7:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
r1 = socket(0x10, 0x3, 0x9)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000002c0), 0x0, 0x0)
r2 = syz_open_procfs(0x0, &(0x7f0000000080)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f798058439ed554fa07424adee901d2da75af1f02acc7edbcd7a071fb35331ce39c5a")
sendfile(r1, r2, &(0x7f00000000c0), 0x80000002)
ioctl(r0, 0x8912, &(0x7f0000000240))
unshare(0x20003fe)
ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000280)=<r3=>0x0)
ioprio_get$pid(0x1, r3)
socketpair(0x1f, 0x0, 0x4, &(0x7f0000000040)={<r4=>0xffffffffffffffff})
ioctl$EVIOCSABS20(r4, 0x401845e0, &(0x7f0000000080)={0x3ff, 0x0, 0x0, 0x9, 0x9, 0x1})
prctl$setmm(0x23, 0x7, &(0x7f0000ffd000/0x2000)=nil)

03:37:04 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x63, 0x0, &(0x7f00000001c0), 0xfffffffffffffee6, 0x0, &(0x7f00000000c0)="52e725be67e2f63fb66b13307d40d40700df9c5dd28a26fc31ad97c82387be3660032b3fef2eba69b337b44fedc1210c915bb1b0e2a21dfba25f0dfd68800d68c16b32204e5e52d2974d8cc486e231b1b768ad67021e665644dc20d32442fa2e0ca8ee975065e3854588ac7b229aad81eb0db4da1be6e0dddd433b02fa7f0000007580a4d53646bde7ae55e8368d27000000000000000000000000000000"})

[  456.882043] device lo entered promiscuous mode
[  456.910232] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=258 sclass=netlink_audit_socket pig=18177 comm=syz-executor7
[  456.915515] binder: 18171:18178 ioctl c0306201 20000200 returned -14
[  456.923822] device lo left promiscuous mode
[  456.980559] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=10488 sclass=netlink_audit_socket pig=18177 comm=syz-executor7
[  456.997661] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=1200 sclass=netlink_audit_socket pig=18177 comm=syz-executor7
[  457.016484] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pig=18177 comm=syz-executor7
[  457.031380] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=9348 sclass=netlink_audit_socket pig=18177 comm=syz-executor7
[  457.044821] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=18630 sclass=netlink_audit_socket pig=18177 comm=syz-executor7
[  457.057942] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=64137 sclass=netlink_audit_socket pig=18177 comm=syz-executor7
[  457.071015] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=12712 sclass=netlink_audit_socket pig=18177 comm=syz-executor7
[  457.085767] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=12544 sclass=netlink_audit_socket pig=18177 comm=syz-executor7
[  457.099052] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=5 sclass=netlink_audit_socket pig=18177 comm=syz-executor7
[  457.113155] device lo entered promiscuous mode
[  457.120972] device lo left promiscuous mode
[  457.468850] IPVS: Creating netns size=2536 id=112
[  457.640248] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  457.653733] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  457.709586] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  457.722929] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  457.778160] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  457.791669] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  457.806258] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  457.821611] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  458.465615] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  458.500993] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  458.507238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  458.513844] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:37:07 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:37:07 executing program 6:
r0 = socket$inet(0x10, 0x200000003, 0x80)
sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="240000002d0007031dfffd946fa28300cee60a0009000000001d85680002000000000000", 0x24}], 0x1}, 0x0)

03:37:07 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x800, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000040)='./file0/file0\x00', 0x200001, 0x179)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000a496000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f000400000000000000000000"], 0x90)

03:37:07 executing program 1:
r0 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xffff}, 0x39}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000240)='/dev/keychord\x00', 0x1, 0x0)
sendto$inet6(r1, &(0x7f0000000080)="42bb1efa6bd958285e84a9248de611c25ba3a5de6bf9a3af010511e6913998a5eddda333573748df35dd0a9817d0e0a7efea411c90060534e1932143ce1cc7af38fa614fa7e664c32be068d40489ca107b5f12d1d86ec94282b853f449ee57c36648db8f74c4a5b7a81dec7c32104d241bce95bbe0ae3c1ff9505235ba5509689787dba9a42a6729bcc2bc720891068f4ad1c7a1d6944c01383fef53f30ca22d4fdf7c8c2ebe", 0xa6, 0x800, 0x0, 0x0)
getsockopt$IP_VS_SO_GET_SERVICE(r1, 0x0, 0x483, &(0x7f0000000140), &(0x7f00000001c0)=0x68)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x80011, r0, 0x0)
sigaltstack(&(0x7f0000000000/0x1000)=nil, &(0x7f0000000040))
ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000000))

03:37:07 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={<r2=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2c, 0x0, &(0x7f0000000080)=[@free_buffer={0x40086303, r2}, @acquire, @acquire={0x40046305, 0x3}, @clear_death={0x400c630f, 0x3, 0x1}], 0x0, 0x0, &(0x7f00000003c0)})

03:37:07 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0)
write$UHID_CREATE2(r0, &(0x7f0000000240)={0xb, 'syz1\x00', 'syz1\x00', 'syz1\x00', 0x44, 0x100000001, 0x8, 0x9, 0x6, 0x1be2, "89a07c68770515474afca4a3df7d7a16b4a63bc97914debf2030dc93ed01d07e9a398fa14adb4a31098d007c2bc469b95009b31e0e2ecd9480de1d150442a2a08daecbd3"}, 0x15c)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
set_tid_address(&(0x7f0000000040))
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:37:07 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="0000000000fa18dd78651c804199ce5829ce4f516980e6993c1e56daa093e1dde5dcb23e6b4326a570821160d52675f506725322d3a5df26"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:37:07 executing program 7:
sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x40000000000009)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket$inet6(0xa, 0x2, 0x0)
connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c)
openat$rfkill(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rfkill\x00', 0x8000, 0x0)
syz_open_dev$mice(&(0x7f0000000280)='/dev/input/mice\x00', 0x0, 0x20200)
openat$pfkey(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/self/net/pfkey\x00', 0x0, 0x0)
openat$rfkill(0xffffffffffffff9c, &(0x7f0000000300)='/dev/rfkill\x00', 0x10400, 0x0)
r1 = memfd_create(&(0x7f0000000340)='$ppp1*@\x00', 0x3)
r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='net/ip6_mr_cache\x00')
ioctl$BLKPBSZGET(r2, 0x127b, &(0x7f0000000200))
setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000180)=0x5, 0x4)
sendmmsg(r0, &(0x7f00000002c0), 0x400000000000174, 0x0)
r3 = gettid()
sched_setscheduler(r3, 0x6, &(0x7f0000000140)=0x100000001)
ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f00000000c0)={'yam0\x00', 0x100000000})

03:37:07 executing program 6:
r0 = socket$inet6(0xa, 0x2, 0x0)
ioctl(r0, 0x8912, &(0x7f00000000c0)="0a5cc80700315f85715070")
r1 = socket$inet(0x2, 0x80003, 0x7)
setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000469ffc)=0x7fe, 0x4)
sendto$inet(r1, &(0x7f0000edf000), 0x0, 0x0, &(0x7f0000000000), 0x10)
recvmsg(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001440), 0x0, &(0x7f0000603000)=""/81, 0x51}, 0x0)
r2 = memfd_create(&(0x7f0000000080)=':\x00', 0x1)
ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f0000000100)={0xfffffffffffffa7d, 0x2})

[  459.568395] device lo entered promiscuous mode
03:37:07 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x800)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000580)='/dev/ppp\x00', 0x10400, 0x0)
timerfd_settime(r1, 0x1, &(0x7f00000005c0)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, &(0x7f0000000600))
r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000400)={0xb0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="046304400300000011634840000000000000000001000000000000000000000001000000000000000000000018000000000000003800000000000000", @ANYPTR=&(0x7f0000000180)=ANY=[@ANYBLOB="a52a6480010c0000", @ANYRES32=r2, @ANYBLOB="000000000200000000000000"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="3800000000000000400000000000000020000000000000f02f00000000000000200000000000000038000000000000003800000000000000"], @ANYBLOB="00000080000000000d630000046304400100000011634840030000000000000000000000000000000000000010000000000000000000000068000000000000004800000000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="852a747001000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000003c00000000000000856164660000000002000000533264c1c2bb5993000000002c0000000000000085616466000000000500000000000000040000ddffffff002200000000000000"], @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="380000000000000038000000000000004800000000000000400000000000000038000000000000003800000000000000380000000000000078000000000000001800000000000000"], @ANYBLOB="06000000000000000d630000"], 0x1, 0x0, &(0x7f0000000240)='{'})
write(r2, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x10, r2, 0x0)
clock_gettime(0x0, &(0x7f0000000100)={<r3=>0x0, <r4=>0x0})
mq_timedsend(r2, &(0x7f0000000040)="12ca7ccde07756d8171013bdb9062d123de35d76d39d3c1676e5e4d38aaf209ac29eb41b422504e7e4aafceeb42926c1e4723d35943fcd6d5fddf057dbd743e446102db3ec798d88f4009b5581c9ff56402a5df0325b2a0d7815039646dfffa310756260bab5d46b6944cf05fbcb269a8dc4a2b5fca5ccfad0940e9405d920662c954742653cdf347c52c15a1ebfb11b1a68a6db2a3b8412e042bb5013bca3bf5386ba8fa37725208406e3bbe639ff", 0xaf, 0x7ff, &(0x7f0000000140)={r3, r4+30000000})
sendfile(r2, r2, &(0x7f0000317000)=0xfffffffffffffffe, 0xff8)
write$FUSE_GETXATTR(r2, &(0x7f0000000540)={0x18, 0x0, 0x2, {0x4}}, 0x18)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})
fchdir(r2)

[  459.597379] device lo left promiscuous mode
[  459.606222] binder: 18570:18575 ioctl c018620b 20000040 returned -14
[  459.607005] binder: 18570:18575 ioctl c0306201 20000440 returned -14
[  459.613978] binder: 18570:18575 ioctl c018620b 20000040 returned -14
03:37:07 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={<r2=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2c, 0x0, &(0x7f0000000080)=[@free_buffer={0x40086303, r2}, @acquire, @acquire={0x40046305, 0x3}, @clear_death={0x400c630f, 0x3, 0x1}], 0x0, 0x0, &(0x7f00000003c0)})

03:37:07 executing program 7:
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @dev}, 0x10)
sendto$inet(r0, &(0x7f0000000040), 0x0, 0x20000800, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10)
sched_setaffinity(0x0, 0x3cb, &(0x7f00000000c0)=0x9)
r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_threshold\x00', 0x2, 0x0)
ioctl$VT_OPENQRY(r1, 0x5600, &(0x7f00000001c0))
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, &(0x7f0000000480))
mmap(&(0x7f00001bf000/0x2000)=nil, 0x2000, 0x0, 0x4011, 0xffffffffffffffff, 0x0)
creat(&(0x7f00000000c0)='./file0\x00', 0x0)
getsockopt$ARPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x60, &(0x7f00000002c0)={'filter\x00'}, &(0x7f0000000340)=0x44)
setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000140)="db04", 0x2)
sendto$inet(r0, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0), 0x6)
sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x1c, 0x0, 0x304, 0x70bd2c, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}]}, 0x1c}}, 0x0)

03:37:07 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)=<r2=>0x0)
fcntl$lock(r0, 0x6, &(0x7f0000000080)={0x1, 0x4, 0x5, 0x9, r2})
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

[  459.616162] binder: 18570:18588 ioctl c0306201 20000440 returned -14
03:37:07 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})
getsockopt$inet6_buf(r1, 0x29, 0x14, &(0x7f0000000040)=""/23, &(0x7f0000000080)=0x17)

[  459.737695] binder: 18598:18602 ioctl c018620b 20000040 returned -14
[  459.740909] binder: 18605:18607 ioctl c0306201 20000440 returned -14
[  459.754588] binder: 18605:18607 ioctl c0306201 20000440 returned -14
03:37:07 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={<r2=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2c, 0x0, &(0x7f0000000080)=[@free_buffer={0x40086303, r2}, @acquire, @acquire={0x40046305, 0x3}, @clear_death={0x400c630f, 0x3, 0x1}], 0x0, 0x0, &(0x7f00000003c0)})

[  459.789526] binder: 18598:18602 ioctl c0306201 20000440 returned -14
03:37:07 executing program 2:
r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x200000)
ioctl$RTC_ALM_READ(r0, 0x80247008, &(0x7f0000000080))
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r2, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0)
sendfile(r2, r2, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

[  459.831946] binder: 18611:18613 ioctl c0306201 20000440 returned -14
[  459.842013] binder: 18611:18613 ioctl c0306201 20000440 returned -14
[  459.891781] binder: 18619:18620 ioctl c0306201 20000440 returned -14
[  459.906718] binder: 18615:18616 ioctl c018620b 20000040 returned -14
[  459.918917] binder: 18615:18616 ioctl c0306201 20000440 returned -14
[  459.943021] device lo entered promiscuous mode
[  459.954214] device lo left promiscuous mode
03:37:07 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:37:07 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

[  460.070224] binder: 18627:18628 ioctl c0306201 20000440 returned -14
[  460.078517] binder: 18627:18628 ioctl c0306201 20000440 returned -14
03:37:08 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0xfffffffffffffffd, 0x0)
setsockopt$inet_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x3, 0x4)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
connect(r1, &(0x7f0000000040)=@ax25={0x3, {"c677c822420674"}, 0x200}, 0x80)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:37:08 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={<r2=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2c, 0x0, &(0x7f0000000080)=[@free_buffer={0x40086303, r2}, @acquire, @acquire={0x40046305, 0x3}, @clear_death={0x400c630f, 0x3, 0x1}], 0x0, 0x0, &(0x7f00000003c0)})

03:37:08 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={'\x00', 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0900000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
fcntl$F_GET_RW_HINT(r3, 0x40b, &(0x7f0000000200))
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:37:08 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
r1 = open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
getsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000000040), &(0x7f0000000240)=0x1)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)
r2 = gettid()
r3 = getpgrp(0xffffffffffffffff)
rt_tgsigqueueinfo(r2, r3, 0xc, &(0x7f0000000180)={0x26, 0x1, 0x7, 0x45})

03:37:08 executing program 2:
r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200)='/dev/sequencer2\x00', 0x1, 0x0)
ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f0000000240)={'tunl0\x00', @dev={[], 0x15}})
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r2, &(0x7f0000000000)="a8588315000267fce0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0)
setsockopt$IP_VS_SO_SET_ZERO(r2, 0x0, 0x48f, &(0x7f00000001c0)={0x4, @broadcast, 0x4e23, 0x0, 'fo\x00', 0x3d, 0x9}, 0x2c)
ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000040))
r3 = openat$cgroup_ro(r0, &(0x7f0000000300)='memory.events\x00', 0x0, 0x0)
sendfile(r2, r2, &(0x7f0000317000), 0xff8)
read(r3, &(0x7f0000000340)=""/242, 0xf2)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:37:08 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

[  460.378166] device lo entered promiscuous mode
[  460.396710] device lo left promiscuous mode
[  460.409388] binder: 18635:18637 ioctl c0306201 20000440 returned -14
[  460.416654] binder: 18636:18640 ioctl c018620b 20000040 returned -14
[  460.417186] binder: 18636:18640 ioctl c0306201 20000440 returned -14
[  460.466545] binder: 18646:18649 ioctl c018620b 20000040 returned -14
03:37:08 executing program 6:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x80000001}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0)
ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f0000000340))
r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0)
ioctl$TIOCNOTTY(r0, 0x5422)
r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
write(r0, &(0x7f0000000400)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200)
sendfile(r0, r1, 0x0, 0x10000)
ioctl$TCSETAW(r2, 0x5407, &(0x7f0000000040)={0x2, 0x40, 0x6, 0x2, 0x2, 0x0, 0x5, 0x1, 0x3ff, 0x1})
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={<r3=>0x0}, &(0x7f0000000140)=0xc)
ioctl$SCSI_IOCTL_GET_PCI(r2, 0x5387, &(0x7f0000000200))
ioctl$RTC_EPOCH_SET(r0, 0x4008700e, 0xf96)
write$cgroup_pid(r0, &(0x7f0000000180)=r3, 0x12)
ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f00000001c0)={0x3, 0x38, 0x17, 0x1a, 0x8, 0x9, 0x3, 0x2, 0xffffffffffffffff})

03:37:08 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r0, r1, &(0x7f0000000200)=0x100000000005e, 0x9)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300), 0x78, 0x0, &(0x7f0000000180)="1179a19f4a5b408145bebd2b012145e301008211ba482300d67a04a7e176c4806f49804a1f3d7ef74da2cfb91b7a7e7ed05b48195282b51c762693300fe7f131273053e5b7f506003a13f00100000000000000747704d8e4cc7da4f0f6bcec6b0358c756f440a6b7f7b4b3657a4475d3ebc5bb7406000000"})

03:37:08 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:08 executing program 7:
r0 = socket$inet6(0xa, 0x0, 0x0)
r1 = dup(r0)
ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000200)=0x5)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = fcntl$getown(r1, 0x9)
ioctl$BLKIOMIN(r1, 0x1278, &(0x7f0000000340))
r3 = syz_open_procfs(r2, &(0x7f00000001c0)='net/netlink\x00')
ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000540)={[], 0x8, 0x6, 0x4, 0x1ff, 0x3, r2})
bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e20}, 0x1c)
sendto$inet6(0xffffffffffffffff, &(0x7f00000007c0), 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r4 = open(&(0x7f00000008c0)='./file0\x00', 0x20141042, 0x0)
ftruncate(r4, 0x80080)
sendto$inet(r4, &(0x7f0000000240)="2590e75c412f44bec81babcbe5d57f41388c", 0x12, 0x4004040, 0x0, 0x0)
r5 = socket$inet(0x2, 0x4000000000000001, 0x0)
r6 = getuid()
syz_mount_image$msdos(&(0x7f0000000600)='msdos\x00', &(0x7f0000000640)='./file1/file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000bc0)="1ffa15507d6c755fe9a30f1fd8090d774dcf4ba055dc01d3f11fcd21635c8abb81b9170d803b78129cf7148b9daa569101da6823e1bf4f078168fb62b4af98748e82ba11963fc4b8ebc98c32a3006324b82548f2b71f75c6f85b004c9f458c50586c950f9f32f08427b1bb64436692e1a90adb123e34dca2282368c4e5aa5c89d209b1cc8874a80aede2263ffd1d01765ebf082fb0c788a6bf25cf0d7a915d60d6c9f3f7f2ef8ecebd715fc2e0c2c376eb1b88bf1d2f7480745bc3a5605ce7d5831ca54efa182593b943", 0xca, 0x5}], 0x1000, &(0x7f0000001240)=ANY=[@ANYBLOB="666c7573682c747a3d5554432c6e6f646f74732c74696d655f6f66667365743d3078666666666666666666666666666231362c646f74732c666d61736b3d30302830303030303030303030303030303030303030352c6e6f646f74732c7569643d7eeeb5500b076d9a74f1fd2bc090d200a2a63545b0be006e1a3bfe8c1d465cf4b38508b0f720425b3870adafa3197288b1944f3406b3670f86699f75c90d936b47e6868495fa09a5f03222bac77f252c51b555c87990bd4f51f14f5b80cfd4ca5f9c6e73862c50fd6fa052e44d2b8cb8a429da44a81ea087d9606c85f7774965c78d2954bfc7292528792d7ecf9c08903d37d94ce3535daf11629a6285ab9afa323629d92b056db9e4c4083555d03b8c685a0669563cc1ff85f10c58b66ef002268ba9862e7a345dc10943ae070dbeb6de43356b5b6702c41b319d23fab2bef6e26f779c7c39a7e282f2c747c4ec3a310c699bae13e0db11e8d8e2693300e65a16ef500dc13cf9b0bae403689b358eaf2601d97ab8625bd8dac6d8371c00fafcd5a0d6866239d51453526c6968d0f5e630b29aaeec6ee5c948eeec81f4b24d363103eb7a195ab694073f6ff7f5824aace0daa7328ec3ba2b3fb57f00981745635383bcd8f83f000000c9e09a705e4fec3b4b2f4ed66b256ac5e04141cb1d90b5e3887500ab6013c4f7b0adf1eae7f9a21fca98358dfd3fe24781b237e54e4252c3df8e90c7de856ef812865a54092bf0d2f20ad74f4f92060000003039e31bb1e754ae5e868e53edfe76a08f957b519717e86d0db6f7ac2948373a18fc0c660ed2e41242c92a8670f6a8b517e26a4056c9ce2c62898cd57b9f0edb7db37866ed5d98d400000000000000", @ANYRESHEX=r6])
getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000002c0), &(0x7f0000000300)=0x4)
bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10)
sendto$inet(r5, &(0x7f0000000000), 0xa4, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10)
ioctl$ASHMEM_GET_SIZE(r4, 0x7704, 0x0)
getsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f0000000e40), &(0x7f0000000e80)=0x4)
ioctl$TUNGETFEATURES(r1, 0x800454cf, &(0x7f00000005c0))
setsockopt$inet_opts(r5, 0x0, 0x0, &(0x7f0000000480)="61f107fc86df2d0a88b16226936dffc673aa008e7697432e419f11bf4abe5a3fb786f2a24d832deabb626a596e812647cdc4d319e476faeb311486c4d87036c75a16de243400af929c9981bdf78eafe27e64b3685e3229", 0x57)
pivot_root(&(0x7f0000000840)='./file2\x00', &(0x7f0000000880)='./file0\x00')
setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f00000015c0)="766574683100000000ffffffffffef00", 0xb)
sendmsg(r5, &(0x7f0000000700)={&(0x7f0000000100)=@vsock={0x28, 0x0, 0x0, @reserved}, 0x80, &(0x7f0000000640), 0x0, &(0x7f0000002600)}, 0x0)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$nl_netfilter(r7, &(0x7f0000000180)={&(0x7f00000000c0), 0xc, &(0x7f0000000140)={&(0x7f0000000d00)={0x14, 0x3, 0x2, 0x3}, 0x14}}, 0x0)
setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000040)='tunl0\x00', 0x10)
syz_mount_image$btrfs(&(0x7f0000000280)='btrfs\x00', &(0x7f0000000380)='./file1\x00', 0x10001, 0x1, &(0x7f0000000500)=[{&(0x7f0000000400)="c6b087821bfb34ea22ebf674b903f3d4d9ccd63a609c3ac2bec63ca10a4e246a05c206e7ada6dd", 0x27, 0x9}], 0x0, &(0x7f0000000740)=ANY=[])

03:37:08 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
rmdir(&(0x7f0000000040)='./file0\x00')
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:37:08 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$EVIOCGPHYS(r1, 0x80404507, &(0x7f00000001c0)=""/97)
sendfile(r1, r0, &(0x7f0000317000)=0x20000000000, 0x7)
mount$9p_unix(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='9p\x00', 0x8, &(0x7f0000000100)={'trans=unix,', {[{@access_any='access=any'}, {@debug={'debug', 0x3d, 0x100000000}}, {@uname={'uname', 0x3d, "2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828"}}]}})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:37:08 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

[  460.593498] device lo entered promiscuous mode
[  460.605451] device lo left promiscuous mode
[  460.632517] binder: 18661:18663 ioctl c018620b 20000040 returned -14
03:37:08 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:08 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
ppoll(&(0x7f0000000040)=[{r0, 0x4000}, {r0, 0x40}, {r1, 0x20}], 0x3, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000100)={0x3ff}, 0x8)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

[  460.710821] binder: 18676:18680 ioctl c0306201 20000440 returned -14
[  460.870592] binder: 18690:18697 ioctl c0306201 20000440 returned -14
[  461.579001] binder: 18690:18697 ioctl c0306201 20000440 returned -14
[  463.028393] IPVS: Creating netns size=2536 id=113
[  463.204513] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  463.218677] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  463.273359] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  463.288044] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  463.343564] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  463.357515] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  463.372291] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  463.387551] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  464.034137] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  464.070198] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  464.076579] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  464.083208] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:37:12 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:37:12 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:12 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
epoll_create(0x9)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:37:12 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c60726f75705f69643deef93c06b659b82787edbf46aaef4fe73d783e774f9a634a908af630ad", @ANYRESDEC=0x0, @ANYBLOB=',\x00'])
r1 = open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
r2 = getuid()
getresgid(&(0x7f0000000280), &(0x7f0000000300)=<r3=>0x0, &(0x7f0000000340))
mount$fuse(0x0, &(0x7f0000000180)='./file0/file0\x00', &(0x7f0000000240)='fuse\x00', 0x992080, &(0x7f00000005c0)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@allow_other='allow_other'}, {@blksize={'blksize', 0x3d, 0x1000}}, {@default_permissions='default_permissions'}, {@max_read={'max_read', 0x3d, 0x4}}, {@max_read={'max_read', 0x3d, 0x3}}, {@max_read={'max_read', 0x3d, 0x7}}]}})
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
ioctl$RTC_PIE_OFF(r1, 0x7006)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
accept4$unix(r1, 0x0, &(0x7f0000000040), 0x800)
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:37:12 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB="030000000000000008001b00000000003625e4be1c361fb6cc562c656dce30df5ee1c81d5d3dc5c206c8053129d88624e817ab9193c91518bd3f39bcc4277e1e1e4b181e597b81fd5b9055c3faa55d89b05897d1e3c9b30fab78e7cb44de887f996d0c3dfc8d7a2ac79df6772d0ced6b0f292e41d39264632eb1b8f7fc1881561e620db5c88fd7a452760943066fffed7dce9c6caf039a626bee1ed400c49f8670f237740565f226d21ef477bbadc51086bd08b91a371f2f0910c383090e2744c0b098883bd65cd58e7e491f7d93d8942ddd3db4e4da65e407da1da7a368e2f348092fd5f727ec5f2daaf003a1e8be10d4395642e42bcdf9e1a2fa610d8b0dfa2fd0d2c3b0d71e19c1231531df61b8758df0e0e9583b9cc689a258db3aa8c11e8588e645124ca3dd17db63daa872e82b2646bc0361003a9aebd6ffcb075982d5ab4abba23750da725972304a3dadd6472e511d02ba15230342ab6ca19acf49e50636d61ec5c72f5b4f01013cba36ef786fed56688b427a14235dbc81c7ad7bebf5de23c9504aabfa14f1b0dea5aa30cff9dbee4ea89033e26229d86beb83c0b11a5244eb127fa40e3af35395ae9231571e32a5f1dacd61eb105b13"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:37:12 executing program 6:
perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x80000001}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0)
ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f0000000340))
r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0)
ioctl$TIOCNOTTY(r0, 0x5422)
r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
write(r0, &(0x7f0000000400)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200)
sendfile(r0, r1, 0x0, 0x10000)
ioctl$TCSETAW(r2, 0x5407, &(0x7f0000000040)={0x2, 0x40, 0x6, 0x2, 0x2, 0x0, 0x5, 0x1, 0x3ff, 0x1})
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={<r3=>0x0}, &(0x7f0000000140)=0xc)
ioctl$SCSI_IOCTL_GET_PCI(r2, 0x5387, &(0x7f0000000200))
ioctl$RTC_EPOCH_SET(r0, 0x4008700e, 0xf96)
write$cgroup_pid(r0, &(0x7f0000000180)=r3, 0x12)
ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f00000001c0)={0x3, 0x38, 0x17, 0x1a, 0x8, 0x9, 0x3, 0x2, 0xffffffffffffffff})

03:37:12 executing program 7:
r0 = socket$inet6(0xa, 0x0, 0x0)
r1 = dup(r0)
ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000200)=0x5)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r2 = fcntl$getown(r1, 0x9)
ioctl$BLKIOMIN(r1, 0x1278, &(0x7f0000000340))
r3 = syz_open_procfs(r2, &(0x7f00000001c0)='net/netlink\x00')
ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000540)={[], 0x8, 0x6, 0x4, 0x1ff, 0x3, r2})
bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e20}, 0x1c)
sendto$inet6(0xffffffffffffffff, &(0x7f00000007c0), 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c)
r4 = open(&(0x7f00000008c0)='./file0\x00', 0x20141042, 0x0)
ftruncate(r4, 0x80080)
sendto$inet(r4, &(0x7f0000000240)="2590e75c412f44bec81babcbe5d57f41388c", 0x12, 0x4004040, 0x0, 0x0)
r5 = socket$inet(0x2, 0x4000000000000001, 0x0)
r6 = getuid()
syz_mount_image$msdos(&(0x7f0000000600)='msdos\x00', &(0x7f0000000640)='./file1/file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000bc0)="1ffa15507d6c755fe9a30f1fd8090d774dcf4ba055dc01d3f11fcd21635c8abb81b9170d803b78129cf7148b9daa569101da6823e1bf4f078168fb62b4af98748e82ba11963fc4b8ebc98c32a3006324b82548f2b71f75c6f85b004c9f458c50586c950f9f32f08427b1bb64436692e1a90adb123e34dca2282368c4e5aa5c89d209b1cc8874a80aede2263ffd1d01765ebf082fb0c788a6bf25cf0d7a915d60d6c9f3f7f2ef8ecebd715fc2e0c2c376eb1b88bf1d2f7480745bc3a5605ce7d5831ca54efa182593b943", 0xca, 0x5}], 0x1000, &(0x7f0000001240)=ANY=[@ANYBLOB="666c7573682c747a3d5554432c6e6f646f74732c74696d655f6f66667365743d3078666666666666666666666666666231362c646f74732c666d61736b3d30302830303030303030303030303030303030303030352c6e6f646f74732c7569643d7eeeb5500b076d9a74f1fd2bc090d200a2a63545b0be006e1a3bfe8c1d465cf4b38508b0f720425b3870adafa3197288b1944f3406b3670f86699f75c90d936b47e6868495fa09a5f03222bac77f252c51b555c87990bd4f51f14f5b80cfd4ca5f9c6e73862c50fd6fa052e44d2b8cb8a429da44a81ea087d9606c85f7774965c78d2954bfc7292528792d7ecf9c08903d37d94ce3535daf11629a6285ab9afa323629d92b056db9e4c4083555d03b8c685a0669563cc1ff85f10c58b66ef002268ba9862e7a345dc10943ae070dbeb6de43356b5b6702c41b319d23fab2bef6e26f779c7c39a7e282f2c747c4ec3a310c699bae13e0db11e8d8e2693300e65a16ef500dc13cf9b0bae403689b358eaf2601d97ab8625bd8dac6d8371c00fafcd5a0d6866239d51453526c6968d0f5e630b29aaeec6ee5c948eeec81f4b24d363103eb7a195ab694073f6ff7f5824aace0daa7328ec3ba2b3fb57f00981745635383bcd8f83f000000c9e09a705e4fec3b4b2f4ed66b256ac5e04141cb1d90b5e3887500ab6013c4f7b0adf1eae7f9a21fca98358dfd3fe24781b237e54e4252c3df8e90c7de856ef812865a54092bf0d2f20ad74f4f92060000003039e31bb1e754ae5e868e53edfe76a08f957b519717e86d0db6f7ac2948373a18fc0c660ed2e41242c92a8670f6a8b517e26a4056c9ce2c62898cd57b9f0edb7db37866ed5d98d400000000000000", @ANYRESHEX=r6])
getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000002c0), &(0x7f0000000300)=0x4)
bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10)
sendto$inet(r5, &(0x7f0000000000), 0xa4, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10)
ioctl$ASHMEM_GET_SIZE(r4, 0x7704, 0x0)
getsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f0000000e40), &(0x7f0000000e80)=0x4)
ioctl$TUNGETFEATURES(r1, 0x800454cf, &(0x7f00000005c0))
setsockopt$inet_opts(r5, 0x0, 0x0, &(0x7f0000000480)="61f107fc86df2d0a88b16226936dffc673aa008e7697432e419f11bf4abe5a3fb786f2a24d832deabb626a596e812647cdc4d319e476faeb311486c4d87036c75a16de243400af929c9981bdf78eafe27e64b3685e3229", 0x57)
pivot_root(&(0x7f0000000840)='./file2\x00', &(0x7f0000000880)='./file0\x00')
setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f00000015c0)="766574683100000000ffffffffffef00", 0xb)
sendmsg(r5, &(0x7f0000000700)={&(0x7f0000000100)=@vsock={0x28, 0x0, 0x0, @reserved}, 0x80, &(0x7f0000000640), 0x0, &(0x7f0000002600)}, 0x0)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$nl_netfilter(r7, &(0x7f0000000180)={&(0x7f00000000c0), 0xc, &(0x7f0000000140)={&(0x7f0000000d00)={0x14, 0x3, 0x2, 0x3}, 0x14}}, 0x0)
setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000040)='tunl0\x00', 0x10)
syz_mount_image$btrfs(&(0x7f0000000280)='btrfs\x00', &(0x7f0000000380)='./file1\x00', 0x10001, 0x1, &(0x7f0000000500)=[{&(0x7f0000000400)="c6b087821bfb34ea22ebf674b903f3d4d9ccd63a609c3ac2bec63ca10a4e246a05c206e7ada6dd", 0x27, 0x9}], 0x0, &(0x7f0000000740)=ANY=[])

03:37:12 executing program 2:
r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x800)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
ioctl$FIBMAP(r1, 0x1, &(0x7f0000000040)=0x10000)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:37:12 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:13 executing program 4:
r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/enforce\x00', 0x101000, 0x0)
openat$cgroup_subtree(r0, &(0x7f0000000280)='cgroup.subtree_control\x00', 0x2, 0x0)
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB="2c726f6f746d6f64653df80c3030303030303030303030303030303034303030302c757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'])
ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000040)=<r2=>0x0)
write$P9_RGETLOCK(r1, &(0x7f0000000180)={0x1e, 0x37, 0x2, {0x1, 0x8, 0x2, r2}}, 0x1e)
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r1, &(0x7f00000030c0), 0x1000)
read$FUSE(r1, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r1, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:37:13 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000040)=0x4)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000000c0)={{{@in=@rand_addr, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r2=>0x0}}, {{@in6=@local}, 0x0, @in6}}, &(0x7f00000001c0)=0xe8)
ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000200)={@mcast2, @mcast2, @remote, 0x8, 0x93, 0x5d28, 0x400, 0x0, 0x4440004, r2})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

[  465.142147] device lo entered promiscuous mode
[  465.157434] binder: 19090:19092 ioctl c0306201 20000440 returned -14
[  465.169373] binder: 19090:19108 ioctl c0306201 20000440 returned -14
03:37:13 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

[  465.187668] binder: 19107:19109 ioctl c018620b 20000040 returned -14
03:37:13 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
sync()
r1 = open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
r2 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r2, 0x8912, &(0x7f0000000280)="025cc80700145f8f764070")
r3 = socket$inet(0x2, 0x1, 0x0)
setsockopt$inet_tcp_int(r3, 0x6, 0x13, &(0x7f0000001ffc)=0x1, 0x4)
mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0)
getsockopt$inet_tcp_int(r3, 0x6, 0x14, &(0x7f000000bffc), &(0x7f0000000040)=0x4)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
ioctl$ASHMEM_GET_PIN_STATUS(r1, 0x7709, 0x0)
write$FUSE_DIRENT(r0, &(0x7f0000000040)=ANY=[@ANYRES32], 0xfffffffffffffdc1)

03:37:13 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

[  465.260073] binder: 19119:19126 ioctl c018620b 20000040 returned -14
[  465.266690] device lo left promiscuous mode
03:37:13 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
unlink(&(0x7f00000001c0)='./file0\x00')
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
signalfd4(r1, &(0x7f0000000240)={0x2f}, 0x8, 0x80800)
ioctl$PIO_UNIMAP(r1, 0x4b67, &(0x7f0000000080)={0xa, &(0x7f0000000040)=[{}, {0xc1f, 0xfffffffffffffffe}, {0x0, 0xbdf7}, {0x7, 0x2}, {0x8, 0x8}, {0x3, 0x10000000000}, {0x5, 0x6}, {0xc, 0x8000}, {0x1000, 0x101}, {0xfffffffffffffe01, 0x4}]})
ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f00000000c0))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:37:13 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

[  465.356306] binder: 19138:19143 ioctl c018620b 20000040 returned -14
[  465.376075] binder: 19140:19144 ioctl 81009431 200000c0 returned -22
[  465.384566] binder: 19140:19144 ioctl c0306201 20000440 returned -14
[  465.412918] binder: 19140:19149 ioctl 81009431 200000c0 returned -22
[  465.489583] device lo entered promiscuous mode
[  465.496475] device lo left promiscuous mode
03:37:13 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
close(0xffffffffffffffff)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:37:13 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:13 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$SNDRV_TIMER_IOCTL_STATUS(r1, 0x80605414, &(0x7f0000000040)=""/42)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:37:13 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000000)=0x1)
socketpair(0x1, 0x1, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)="6c6f00966fd651b159a9c84a2c60d29800000020")
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
setsockopt$inet_buf(r1, 0x0, 0x2b, &(0x7f0000000240)="bc9d30f2af6722b22d71ffe6e5c62903a57ce9ff0055df10b166b584bf894e9787c2f1fd681d6762c4b1ae634d83b087ed59d3fed6a3d3537a65a34c8db344620c5e4fb50b9c2dede719c59a914d7a6ddd278a3ba76e371c717403d59967491d9aca0f15966cb3910234ea0a37e8520f2c53729981791694d9726dd7ddbb6c6d11da78a7ac31f2b66819fa1ce361a40eafe4ae05908f102583382fb141b650c7877b7074d3613b7a226c74398d53f3979872f8d97984b46beea88b2e21f13630fab0515bb11a8687578ccf6aba3cbe7d5e06c121d22945eff864fdfe", 0xdc)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

[  465.609709] device lo entered promiscuous mode
03:37:13 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

[  465.632152] device lo left promiscuous mode
[  465.656926] binder: 19157:19161 ioctl c0306201 20000440 returned -14
[  465.675817] binder: 19157:19169 ioctl c0306201 20000440 returned -14
[  465.807001] device lo entered promiscuous mode
[  465.813750] device lo left promiscuous mode
03:37:13 executing program 6:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000000)="0a5cc80700315f85715070")
r1 = syz_open_dev$sndtimer(&(0x7f0000f85ff1)='/dev/snd/timer\x00', 0x0, 0x0)
ppoll(&(0x7f0000000540)=[{r1}], 0x1, &(0x7f0000000580)={0x0, 0x989680}, &(0x7f00000005c0), 0x8)

03:37:13 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:13 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x1)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0xae2e, 0xb9eb, 0x8001, 0x3}]}, 0x10)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})
fadvise64(r0, 0x39, 0x6, 0x1)
lseek(r1, 0x0, 0x7)
ioctl$KDSKBSENT(r1, 0x4b49, &(0x7f00000000c0)="43e1632b714ace042e46021291d5739e4854a2bc58d1718dd17da7055a328bfead2fd5a992e87eafe8b417128320699a887830c16e4c23f04adeec7df25b8ba6918dcaa76ad323078d34eee29c675193d146d89b895e4178d46a6acaf04611417f3face3ed480c0476132839f7695837764657ea83b112aeb3131b6b8338adf8d6de4de33de3de3a501e94a8c5f522a190551e9bb6910f")

03:37:13 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f0000000000))
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:37:13 executing program 7:
r0 = socket(0x10, 0x2, 0x0)
getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, <r1=>0x0}, &(0x7f0000cab000)=0xc)
setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'ip6_vti0\x00', 0x2}, 0x18)
setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r0, 0x111, 0x1, 0x9, 0x4)
setresuid(r1, r1, r1)
setfsuid(0x0)

03:37:13 executing program 1:
r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r0, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040))

03:37:13 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
r5 = gettid()
get_robust_list(r5, &(0x7f0000000380)=&(0x7f0000000340)={&(0x7f0000000280)={&(0x7f0000000200)}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)}}, &(0x7f0000000400)=0x18)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

[  465.987702] device lo entered promiscuous mode
[  466.024601] binder: 19184:19187 ioctl c0306201 20000440 returned -14
[  466.031193] device lo left promiscuous mode
[  466.052935] binder: 19184:19201 ioctl c0306201 20000440 returned -14
[  466.157233] device lo entered promiscuous mode
[  466.166877] device lo left promiscuous mode
03:37:14 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0xff2a, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}}, 0x11)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000680)=ANY=[@ANYBLOB="90000000f56c6dd05a6800000000000002000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b81de1eb9cc6370757365746367000000000000000000000000000000000000000000000037e6263003b21aea927bfc2ae3bbb2c7348129bddd6358b4d37820a154bf341178d44684352786cd8fe3b0fa50b23c5c037af78dffdcf958182077a652db016d0aef01f1241283ccaf988ba1bee91d923681864c5f16c505eaaa346b2345f9970d2695ff6fabdcf42b036a9f9964f852fd864993e75c7564b3d71e95ec3a51d8e2029aa15fca53b682b958132f8fcf7c44359ac526296c51e7e14b651f3145de37ae4ebb0e27f2a2912b574d10a991c7098d3aa037bd2e711c8ac4cba3ab20facac68f43fc2ae3e16a000000000000000000"], 0x90)

03:37:14 executing program 7:
mkdir(&(0x7f0000000500)='./file0\x00', 0x0)
mount(&(0x7f0000000480)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000002c0))
mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0))
ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'team0\x00'})
mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000280)='./file0\x00', &(0x7f0000000540)="a30d942aece9ce77f260c3796cef37c5836c6bd18ada870b1abd4ce3275a608efdea5dab7d559728d12ca10793ce04af832ff86f7468eb0463d595aa3bf790e787a81e9cb03e12cc2dec", 0x9004, 0x0)
r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0)
mknodat(r0, &(0x7f0000000200)='./file0\x00', 0xc020, 0x1)
mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200))
mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f0000000ac0))
r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x10402, 0x0)
r2 = dup(0xffffffffffffff9c)
renameat2(r1, &(0x7f0000000100)='./file0\x00', r2, &(0x7f0000000180)='./file0\x00', 0x0)
mount(&(0x7f0000377ff8)='.', &(0x7f0000002e80)='./file0\x00', &(0x7f0000753000)='msdos\x00', 0x5010, &(0x7f0000000380))

03:37:14 executing program 6:
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
r0 = socket(0x10, 0x0, 0x0)
perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sendto(r0, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0)
mmap(&(0x7f00001bf000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0)
r1 = openat(0xffffffffffffffff, &(0x7f0000000600)='./file0\x00', 0x800, 0x8)
ioctl$RTC_VL_READ(r1, 0x80047013, &(0x7f0000000640))
r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f00000002c0)=""/164)
r3 = creat(&(0x7f00000005c0)='./file0\x00', 0x136)
mmap(&(0x7f00001b0000/0x12000)=nil, 0x12000, 0x1000008, 0x80012, r2, 0x0)
setsockopt$inet6_MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, &(0x7f0000000380), 0xc)
vmsplice(0xffffffffffffffff, &(0x7f0000000980), 0x0, 0x0)
ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000680)=ANY=[@ANYRESDEC=0x0])
recvmmsg(0xffffffffffffffff, &(0x7f0000009880), 0x0, 0x0, &(0x7f0000009940))
clock_gettime(0x6, &(0x7f0000000800))
getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000003c0)={{{@in6=@mcast1, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in=@multicast1}, 0x0, @in6=@ipv4}}, &(0x7f0000000240)=0xe8)
sendmsg$nl_route_sched(r3, &(0x7f0000000500)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000004c0)={&(0x7f00000006c0)=ANY=[@ANYBLOB="240000002a000c012dbd7000fedbdf2500000000", @ANYRES32=r4, @ANYBLOB="2895050b00917fcc0677acfb2629579e3b8797ee7d736d4334b68d5afeb0039bc33e54183aa4a69d"], 0x24}, 0x1, 0x0, 0x0, 0x40010}, 0x8000)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f000000e0c0)={{{@in6=@dev, @in6=@loopback}}, {{@in6}, 0x0, @in6=@dev}}, &(0x7f000000e1c0)=0xe8)
ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f00000001c0)=@buf={0xad, &(0x7f0000000100)="4737fe38f5483563d90dbc2f02aa6b9317eb06faa9faa1b195fa3c342e53c3e5728fb12d6adbfeebe7c711382c7ea526ba83a0693692a7724368a4ba02c673727ef4a5434f6983aefdf243f42e704371ef47078f6cd3cf2cf8956d287959a4991fe0496c796fcaa2b516f9542bf7a5104d53ca0ca24643976fc316020beb7f65dc79e8325ef299e89df70b84362350b5b2b58fa9c18aad33e2dd3ae378a95d5683d7f71c79bd77d5eec384bdcf"})
getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f000000e800), &(0x7f000000e840)=0xc)
write$selinux_access(r3, &(0x7f0000000540)={'system_u:object_r:wtmp_t:s0', 0x20, '/usr/lib/telepathy/mission-control-5', 0x20, 0x100000000}, 0x56)

03:37:14 executing program 1:
r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r0, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040))

[  468.369418] IPVS: Creating netns size=2536 id=114
[  468.540508] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  468.554086] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  468.609737] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  468.622946] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  468.678832] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  468.692303] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  468.706683] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  468.721689] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  469.369475] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  469.403763] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  469.410293] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  469.418035] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:37:18 executing program 1:
r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r0, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040))

03:37:18 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f00000000c0)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8e03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e11f27730e90f2cd72b828", 0x1)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
write$P9_RVERSION(r1, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.L'}, 0x15)
ioctl$SG_GET_LOW_DMA(r1, 0x227a, &(0x7f0000000140))
sendfile(r1, r1, &(0x7f0000000080), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:37:18 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0)
ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r1, 0x40505331, &(0x7f0000000040)={{0x3, 0x1}, {0x6, 0x4}, 0x2, 0x6, 0x7})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'bridge0\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:37:18 executing program 3:
r0 = syz_open_dev$loop(&(0x7f0000000340)='/dev/loop#\x00', 0x4, 0x10000)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
ioctl$TCGETA(r4, 0x5405, &(0x7f00000002c0))
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="1b00040000007305cc5f09aa665cd611eb385faea4eaaf46076d5b7c90b8"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
getrlimit(0xf, &(0x7f0000000200))
r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$TIOCGPGRP(r5, 0x540f, &(0x7f0000000280)=<r6=>0x0)
r7 = getpid()
tgkill(r6, r7, 0xc)
ioctl$LOOP_SET_FD(r0, 0x4c00, r5)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:37:18 executing program 6:
r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
socket$inet6(0xa, 0xa, 0x0)
r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ppp\x00', 0x40000, 0x0)
sendmsg$nl_generic(r1, &(0x7f0000000480)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x18, 0x3b, 0xc, 0x70bd2a, 0x25dfdbfe, {0xc}, [@typed={0x4, 0x49}]}, 0x18}, 0x1, 0x0, 0x0, 0x800}, 0x0)
openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/pmtu_disc\x00', 0x2, 0x0)
ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82)
r2 = memfd_create(&(0x7f0000000380)="3fbeaeec9b3af1bdd4c9adf22cb5234ab98cecf21f709d7c7e9c410369f3932b2f52008e7110949cf6704bde5ece3e8e02ba60d6851194b6e2a23f877fc79a4edd7616cdad8bdea2d4d31484a6ad2892c6c47ce2db4e082eab59759c9a131443f182e8f0d7db77984e0687c7cd", 0x3)
pwritev(r0, &(0x7f0000000240), 0x1000000000000034, 0xfffffffffffffffe)
fcntl$addseals(r2, 0x409, 0x8)
ioctl$BLKIOMIN(0xffffffffffffffff, 0x1278, &(0x7f0000000100))
fcntl$notify(0xffffffffffffffff, 0x402, 0x0)
fstatfs(r2, &(0x7f00000002c0)=""/157)
ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000280)="0a5cc8")
lseek(0xffffffffffffffff, 0x0, 0x3)

03:37:18 executing program 7:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070")
r1 = socket$inet6(0xa, 0x1, 0x0)
mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0)
r2 = userfaultfd(0x0)
ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000))
ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1})
r3 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_mreqsrc(r1, 0x0, 0x5, &(0x7f0000013ff4)={@dev={0xac, 0x14, 0x14, 0x11}, @rand_addr, @remote}, 0xc)
getsockopt$inet_int(r3, 0x0, 0xe, &(0x7f0000000000), &(0x7f0000000040)=0x4)
close(r3)
dup3(r1, r2, 0x0)

03:37:18 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
close(0xffffffffffffffff)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:37:18 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
acct(&(0x7f0000000180)='./file0/file0\x00')
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x200}}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
r1 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0x0)
keyctl$clear(0x7, r1)
signalfd4(r0, &(0x7f0000000040)={0x7fffffff}, 0x8, 0x80800)
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:37:18 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:18 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
setsockopt$IP_VS_SO_SET_ZERO(r1, 0x0, 0x48f, &(0x7f0000000040)={0x0, @multicast2, 0x4e23, 0x800000000000002, 'fo\x00', 0x32, 0x4, 0x19}, 0x2c)
openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x281, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={<r2=>0x0}, &(0x7f0000000100)=0xc)
sched_setaffinity(r2, 0x8, &(0x7f0000000140)=0x43)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

[  470.515250] binder: 19609:19613 ioctl c0306201 20000440 returned -14
03:37:18 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})
setsockopt$inet_MCAST_LEAVE_GROUP(r1, 0x0, 0x2d, &(0x7f0000000040)={0x3, {{0x2, 0x4e21, @multicast2}}}, 0x88)

03:37:18 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:18 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=<r1=>0x0)
fcntl$lock(r0, 0x7, &(0x7f0000000040)={0x2, 0x2, 0x9, 0xa2b, r1})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:37:18 executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
close(0xffffffffffffffff)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:37:18 executing program 7:
r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x8005, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, r0, 0x0)
read(r1, &(0x7f0000000040)=""/91, 0x5b)
lseek(r1, 0x0, 0x1)
r2 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x7, 0x40)
r3 = socket$l2tp(0x18, 0x1, 0x1)
epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r3)

[  470.572832] binder: 19629:19636 ioctl c018620b 20000040 returned -14
[  470.597353] binder: 19626:19630 ioctl c0306201 20000440 returned -14
03:37:18 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

[  470.650062] binder: 19647:19649 ioctl c0306201 20000440 returned -14
[  470.674490] device lo entered promiscuous mode
[  470.683905] binder: 19652:19665 ioctl c018620b 20000040 returned -14
03:37:18 executing program 7:
r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0)
getsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000280), &(0x7f00000002c0)=0x4)
syz_open_dev$usbmon(&(0x7f0000000240)='/dev/usbmon#\x00', 0x0, 0x604800)
r1 = socket$inet(0x10, 0x80002, 0x0)
r2 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0x80000000, 0x143000)
socket$nl_route(0x10, 0x3, 0x0)
sendmsg(r1, &(0x7f0000004fc8)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="2f0000001800030007fffd946fa283bc8020000000040005031d856813000900083c14cc16ccbb24e0710b42fa3ccc", 0x2f}], 0x1}, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
fcntl$getownex(r2, 0x10, &(0x7f0000000880))
getegid()
r3 = socket(0xb, 0x802, 0x0)
write(r3, &(0x7f0000000140)="fc00000049000700ab092500090007000aab0700000000001d00369321000100ff0100000005d0000000000000039815fa2c1ec28656aaa79bb94b46fe000000bc00020000000000000000272f2e117c22ebc205214000000000008934d07302ade01720d7d5bbc91a3e3280772c05defd5a32e280fc83ab82f605f70c9ddef2fe082038f4f8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f295ed94e0ad91bd0734babc7c3f2eeb57d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad0a4f01731d05b0350b0041f0d48a99c03f080548deac270e33429fd3000175e63fb8d38a873cf1587c3b41", 0xfc)

03:37:18 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

[  470.701282] device lo left promiscuous mode
03:37:18 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
r2 = fcntl$getown(r1, 0x9)
r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000600)='IPVS\x00')
sendmsg$IPVS_CMD_FLUSH(r1, &(0x7f0000000500)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000400)={&(0x7f0000000480)={0x74, r3, 0x800, 0x70bd2a, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_DEST={0x48, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [], @broadcast}}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x3}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x4}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x800}, 0x40000)
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000100)={{{@in6=@local, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r4=>0x0}}, {{@in6=@ipv4={[], [], @rand_addr}}, 0x0, @in6=@ipv4={[], [], @multicast1}}}, &(0x7f0000000200)=0xe8)
fstat(r1, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, <r5=>0x0})
setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000240)={r2, r4, r5}, 0xc)
sendfile(r1, r1, &(0x7f0000317000), 0x80)
getrusage(0x0, &(0x7f0000000040))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

[  470.771492] binder: 19669:19672 ioctl c018620b 20000040 returned -14
[  470.839768] binder: 19674:19679 ioctl c0306201 20000440 returned -14
[  470.862582] binder: 19674:19686 ioctl c0306201 20000440 returned -14
03:37:18 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
clock_gettime(0x0, &(0x7f0000000280)={<r5=>0x0, <r6=>0x0})
futex(&(0x7f0000000200)=0x1, 0xf, 0x0, &(0x7f00000002c0)={r5, r6+10000000}, &(0x7f0000000300), 0x2)
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:37:18 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:18 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
close(0xffffffffffffffff)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:37:18 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x100000000004, 0x11, r1, 0x6)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})
syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800)

03:37:18 executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
close(0xffffffffffffffff)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

[  470.994356] device lo entered promiscuous mode
[  471.000230] device lo left promiscuous mode
03:37:18 executing program 7:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
acct(&(0x7f0000000180)='./file0/file0\x00')
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x200}}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
r1 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0x0)
keyctl$clear(0x7, r1)
signalfd4(r0, &(0x7f0000000040)={0x7fffffff}, 0x8, 0x80800)
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:37:18 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x400)
ioctl$UI_SET_MSCBIT(r1, 0x40045568, 0x37)

[  471.069607] binder: 19698:19700 ioctl c018620b 20000040 returned -14
03:37:18 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:18 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000140)={0x2a, 0x4, 0x0, {0x5, 0xe8, 0x2, 0x0, [0x0, 0x0]}}, 0x2a)
setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000100)='scalable\x00', 0x9)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r1, 0x3)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})
keyctl$session_to_parent(0x12)
ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000040)={{0x40, 0x80000000}, 'port0\x00', 0x4, 0x800, 0x921, 0x9, 0x5, 0x8, 0x400, 0x0, 0x1, 0x9})

03:37:19 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

[  471.170337] binder: 19714:19715 ioctl c018620b 20000040 returned -14
[  471.187467] binder: 19710:19717 ioctl c0306201 20000440 returned -14
03:37:19 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f", 0x5)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:19 executing program 2:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000080)={@mcast1}, &(0x7f0000000100)=0x14)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r2, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
write$FUSE_INIT(r2, &(0x7f0000000200)={0x50, 0xfffffffffffffffe, 0x3, {0x7, 0x1b, 0x9, 0x80020, 0x62c, 0x80, 0x4f, 0x2}}, 0x50)
accept4$unix(r2, &(0x7f0000000180), &(0x7f00000000c0)=0x4d5, 0x80002)
setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000480)=ANY=[@ANYBLOB="66696c746572000000000000000000000000000000000000000000000000000007000000040000008004000060020000000000000000000098030000980300009803000004000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="000000000000000500000000000000001e00800000e759434f2511a54f307c7b6de0ae00000000010000000000000000000000000000000000000000000000c2"], @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f000200100000000000000000000000000000000000000000000000000003000434f4e4e4d41524b0000000000000000000000000000000000000000000104000000060000000600000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0004001000000000000000000000000000000000000000000000000000050006d616e676c65000000000000000000000000000000000000000000000000aaaaaaaaaa0a0000000000000000000000000000000000000000000000000000ac1414bbac1414bb0600000000000000ac1414bbac1414bbffffffffff00000000000000000000000000000000000000000000000000000000ff0000ffff00000000000000000000aaaaaaaaaa1e0000000000000000000000000000000000000000ff0000000000000000000000000000d00101040000070026ffff6772657461703000000000000000000069726c616e300000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000000000000000ff0000000000000000000000000000000000010000000000000000000000f0003801000000000000000000000000000000000000000000000000000048004c454400000000000000000000000000000000000000000000000000000073797a300000000000000000000000000000000000000000000000000400000007000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c000e8000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff00000000"], 0x4d0)
sendfile(r2, r2, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

[  471.220454] binder: 19710:19723 ioctl c0306201 20000440 returned -14
[  471.230058] binder: 19721:19724 ioctl c018620b 20000040 returned -14
03:37:19 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:19 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
r2 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2)
ioctl$SG_NEXT_CMD_LEN(r2, 0x2283, &(0x7f00000000c0)=0x4b)
write$binfmt_elf64(r2, &(0x7f0000000300)={{0x7f, 0x45, 0x4c, 0x46, 0x6, 0x3, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, [{}]}, 0x78)
r3 = socket$inet6(0xa, 0x3, 0x1)
connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x3, @ipv4={[], [], @rand_addr=0x9}, 0x9}, 0x1c)
bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x7fff, @dev, 0xfffffffffffffffd}, 0x1c)
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x101000, 0x0)
ioctl$TCSETS(r4, 0x5402, &(0x7f0000000100)={0xffff, 0x11c9, 0x2000000000000000, 0xffff, 0x5e2, 0x100, 0x0, 0x1})
openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x40800, 0x0)
ioctl$TIOCLINUX7(r4, 0x541c, &(0x7f00000000c0)={0x7, 0x400})
ioctl$RTC_UIE_ON(r2, 0x7003)
sendmmsg(r3, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0c00000000000000000000000000009429dcc2a5d5293e0c66fe08"], 0x18}, 0x1f}], 0x1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

[  471.271629] binder: 19727:19730 ioctl c018620b 20000040 returned -14
[  471.317345] binder: 19737:19738 ioctl c018620b 20000040 returned -14
[  471.366747] binder: 19739:19740 ioctl c0306201 20000440 returned -14
[  471.378444] binder: 19739:19740 ioctl c0306201 20000440 returned -14
[  471.403166] device lo entered promiscuous mode
[  471.414471] device lo left promiscuous mode
[  471.481630] device lo entered promiscuous mode
03:37:19 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="66643d1b8081b10c988431c773e1ecbd59b585b38772408f96df65523ff35e2ce7ef25e05fb71fcb6d58a18db775e9e8e4063bd77ab4116a763b6da94d53613287b8695de792d9e72149cf7619975e7769100a34783e5fb1e40b8fa6", @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'])
r1 = open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
lstat(&(0x7f0000000680)='./file0/file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0})
write$FUSE_ENTRY(r1, &(0x7f00000005c0)={0x90, 0x0, 0x2, {0x6, 0x0, 0x80, 0x3, 0x3, 0xa9, {0x1, 0x7, 0xa87, 0x99, 0x5, 0x7, 0xb4dd, 0x432d, 0x61, 0x70, 0x100, r2, r3, 0x1ff, 0x7fffffff}}}, 0x90)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
ioctl$SCSI_IOCTL_PROBE_HOST(r1, 0x5385, &(0x7f00000006c0)={0xf9, ""/249})
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
mount(&(0x7f00000000c0)='./file0/file1\x00', &(0x7f00000007c0)='./file0\x00', &(0x7f0000000800)='ceph\x00', 0x40000, 0x0)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
ioctl$RTC_IRQP_SET(r1, 0x4008700c, 0x1436)
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)
fcntl$dupfd(r0, 0x406, r1)

03:37:19 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:19 executing program 7:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
acct(&(0x7f0000000180)='./file0/file0\x00')
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x200}}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
r1 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0x0)
keyctl$clear(0x7, r1)
signalfd4(r0, &(0x7f0000000040)={0x7fffffff}, 0x8, 0x80800)
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:37:19 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x2)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=@random={'user.', '/dev/binder#\x00'})
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
r2 = mmap$binder(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x8, 0x80010, r0, 0x4e)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x9c, 0x0, &(0x7f00000001c0)=[@clear_death={0x400c630f, 0x3, 0x1}, @acquire, @transaction_sg={0x40486311, {{0x1, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x40, 0x10, &(0x7f0000000140)=[@fd={0x66642a85, 0x0, r1, 0x0, 0x2}, @ptr={0x70742a85, 0x1, &(0x7f00000000c0), 0x1, 0x4, 0x9}], &(0x7f0000000180)=[0x18, 0x20]}, 0x52a5}}, @request_death={0x400c630e, 0x4, 0x4}, @clear_death={0x400c630f, 0x1}, @register_looper, @increfs_done={0x40106308, r2}], 0x0, 0x0, &(0x7f00000003c0)})

[  471.664497] binder: 19750:19755 ioctl c018620b 20000040 returned -14
[  471.675034] binder: 19753:19754 ioctl c0306201 20000440 returned -14
[  474.869118] IPVS: Creating netns size=2536 id=115
[  475.116923] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  475.130860] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  475.561934] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  475.577569] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  475.632805] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  475.646493] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  475.660804] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  475.675904] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  476.427391] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  476.463256] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  476.469595] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  476.476923] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:37:25 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:37:25 executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
close(0xffffffffffffffff)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:37:25 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:25 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = getpgrp(0xffffffffffffffff)
r5 = getpgrp(r4)
sched_setattr(r5, &(0x7f0000000200)={0x30, 0x1, 0x0, 0x0, 0x8d, 0x1ff, 0xfffffffffffffff9, 0x8}, 0x0)
ioctl$TUNSETNOCSUM(r2, 0x400454c8, 0x1)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r6 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="03c747ab3619861256000e0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r8 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
write$P9_RREAD(r7, &(0x7f0000000400)={0xe3, 0x75, 0x1, {0xd8, "2f1667bccd47a0edf07103fd5d266ed4dc63cb361f02540b33fe906d496ec82169071d547d1726ce60fca7243b4352287b5b9ad17e71fa47c7c6226b4803ef78e4b8c78a3548fc00b0ddaaabc049dfb7ac053e8e635a522c423c8b379b8b982e179f20e373c3105f17e2097c44983a1834b9a73f3015249cc5ed081d2d76195dcb5495b7c9c4576bdc6e8d44fdd2c45cd0fcb477cd64f0b76fdef66538f52da92c91906396a7fa074af915d4a954bed66fe76e61befcc9e4f7247b53171153f2665ce45fa31646c494dd40b1a49d6d99b9da0f694c13785d"}}, 0xe3)
ioctl$LOOP_SET_FD(r0, 0x4c00, r8)
ioctl$EVIOCGEFFECTS(r6, 0x80044584, &(0x7f0000000280)=""/177)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:37:25 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r0 = socket$inet(0x2, 0x802, 0x9)
ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000040)={'nr0\x00', {0x2, 0x4e22, @loopback}})
ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'\x00', 0x2000})
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})

03:37:25 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
r1 = open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0xffffffffffffffff}}, 0x50)
ioctl$TIOCGETD(r1, 0x5424, &(0x7f0000000040))
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:37:25 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:37:25 executing program 7:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
acct(&(0x7f0000000180)='./file0/file0\x00')
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x200}}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
r1 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0x0)
keyctl$clear(0x7, r1)
signalfd4(r0, &(0x7f0000000040)={0x7fffffff}, 0x8, 0x80800)
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:37:25 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$LOOP_SET_FD(r1, 0x4c00, r0)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000040)=[{0x4, 0xffff}], 0x1)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

[  477.588274] binder: 20142:20152 ioctl c018620b 20000040 returned -14
[  477.609141] binder: 20145:20148 ioctl c0306201 20000440 returned -14
[  477.620349] binder: 20145:20156 ioctl c0306201 20000440 returned -14
[  477.640467] device lo left promiscuous mode
03:37:25 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883", 0x3)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:25 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
r2 = syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00')
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@dev, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r3=>0x0}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000400)=0xe8)
getsockopt$inet6_mreq(r1, 0x29, 0x1f, &(0x7f0000000480)={@loopback, <r4=>0x0}, &(0x7f00000004c0)=0x14)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000500)={'ip6tnl0\x00', <r5=>0x0})
ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000540)={'team0\x00', <r6=>0x0})
getpeername$packet(r1, &(0x7f0000000640)={0x11, 0x0, <r7=>0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000680)=0x14)
getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f00000006c0)={{{@in6=@ipv4={[], [], @multicast1}, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r8=>0x0}}, {{@in6=@loopback}, 0x0, @in=@dev}}, &(0x7f00000007c0)=0xe8)
getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000008c0)={{{@in=@loopback, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r9=>0x0}}, {{@in6=@mcast2}, 0x0, @in=@broadcast}}, &(0x7f00000009c0)=0xe8)
ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000a00)={'team0\x00', <r10=>0x0})
getsockopt$inet6_mreq(r1, 0x29, 0x15, &(0x7f0000000a40)={@ipv4={[], [], @local}, <r11=>0x0}, &(0x7f0000000a80)=0x14)
ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000ac0)={'team0\x00', <r12=>0x0})
accept$packet(r1, &(0x7f0000000bc0)={0x11, 0x0, <r13=>0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000c00)=0x14)
getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000c40)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r14=>0x0}}, {{}, 0x0, @in6=@remote}}, &(0x7f0000000d40)=0xe8)
getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000e40)={{{@in6=@loopback, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r15=>0x0}}, {{@in=@local}, 0x0, @in=@rand_addr}}, &(0x7f0000000f40)=0xe8)
getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000f80)={{{@in=@multicast2, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r16=>0x0}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f0000001080)=0xe8)
sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000001640)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10800180}, 0xc, &(0x7f0000001600)={&(0x7f00000010c0)={0x508, r2, 0x500, 0x70bd27, 0x25dfdbfd, {}, [{{0x8, 0x1, r3}, {0x184, 0x2, [{0x4c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x1c, 0x4, [{0x2, 0x8, 0x6, 0x1}, {0x400000000000, 0xfffffffffffffffa, 0x2, 0x80000001}, {0x9, 0x5, 0x1e2780000000000}]}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r4}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x7fff}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r6}}, {0x8}}}]}}, {{0x8, 0x1, r7}, {0x4}}, {{0x8, 0x1, r8}, {0x214, 0x2, [{0x54, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x24, 0x4, [{0x0, 0x101, 0x7, 0x24b}, {0x19, 0x3aa, 0x400, 0x101}, {0x1000, 0x5, 0xfffffffffffffff7}, {0xee7c, 0xa5, 0x2, 0x7}]}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r10}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r11}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffc00}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0xd7b}}, {0x8, 0x6, r12}}}]}}, {{0x8, 0x1, r13}, {0xec, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffff8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xfff}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0xffffffff}}, {0x8, 0x6, r14}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x8}}}]}}, {{0x8, 0x1, r15}, {0x44, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x7fff}}, {0x8, 0x6, r16}}}]}}]}, 0x508}}, 0x4)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

[  477.682504] binder: 20160:20162 ioctl c0306201 20000440 returned -14
03:37:25 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:37:25 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a8", 0x1)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:25 executing program 7:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
acct(&(0x7f0000000180)='./file0/file0\x00')
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x200}}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
r1 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0x0)
keyctl$clear(0x7, r1)
signalfd4(r0, &(0x7f0000000040)={0x7fffffff}, 0x8, 0x80800)

[  477.746924] binder: 20173:20174 ioctl c018620b 20000040 returned -14
03:37:25 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

[  477.797452] binder: 20176:20178 ioctl 8933 20000ac0 returned -22
[  477.809874] binder: 20183:20184 ioctl c018620b 20000040 returned -14
[  477.848725] binder: 20186:20190 ioctl c018620b 20000040 returned -14
[  477.850146] binder: 20176:20178 ioctl c0306201 20000440 returned -14
[  477.864067] binder: 20176:20192 ioctl 8933 20000ac0 returned -22
03:37:25 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

[  477.880523] binder: 20176:20178 ioctl c0306201 20000440 returned -14
[  477.924647] binder: 20195:20198 ioctl c0306201 20000440 returned -14
[  477.988596] device lo entered promiscuous mode
[  477.994351] device lo left promiscuous mode
03:37:25 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f00000001c0)="2d42d54e49c56aba707070f0081772392ebbf10f782ef3fd76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe390fe7d924ce20ab4eaec9bdd36740e127730e90f2cd729828", 0x2)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

[  478.117748] binder: 20209:20210 ioctl c0306201 20000440 returned -14
[  478.126273] binder: 20209:20210 ioctl c0306201 20000440 returned -14
[  478.162801] IPVS: Creating netns size=2536 id=116
[  478.371612] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  478.387230] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  478.446763] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  478.461016] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  478.518944] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  478.533006] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  478.548162] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  478.563472] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  479.240177] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  479.273961] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  479.280163] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  479.287749] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:37:28 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x20000, 0x0)
ioctl$TUNGETIFF(r1, 0x800454d2, &(0x7f0000000240))
r2 = open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
write$P9_RSTAT(r2, &(0x7f0000000300)=ANY=[@ANYBLOB="450b186df4010000003e0001010400000008020000000400000000000000ec9006114c302952250a4249a300002005050000000400000000040000000000000200666401002f0700757365725f696401002a"], 0x45)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x105000, 0x0)
setsockopt$inet6_buf(r2, 0x29, 0xd2, &(0x7f00000005c0)="772edd4047995b2a28e6675540bf3b2bdbcbf84028436c5169603cd95d2fac772857cd04a089386666540ad78f6db1dc758c7105459a13e2637fc507694ad74e4fd44c13c9d66f6aac53905f4b5c2c3fd2da02cc546beaac0e632c2a3d72de8c1762dea53dfbc14bbed79e2180297555b79c8ccddad1f4028695dfdc8c98ca77f0343652a623d6a4367ae7bc79f2d0bdd39618fa09c871b8a759c3a9b4e64d8c35b332f8a8cbd7ff5caf8e73307851a047c70c9f6e08154846f31d3b02639d270f9eca69e339c55780f7c6395938888e66e3a7", 0xd3)
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:37:28 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:37:28 executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
close(0xffffffffffffffff)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:37:28 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:28 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82)
ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2)
sendfile(r1, r1, &(0x7f0000317000)=0x1, 0x8000)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})
renameat2(r1, &(0x7f0000000040)='./file0\x00', r1, &(0x7f0000000080)='./file0\x00', 0x6)

03:37:28 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x220000)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:37:28 executing program 7:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
acct(&(0x7f0000000180)='./file0/file0\x00')
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x200}}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
r1 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0x0)
keyctl$clear(0x7, r1)
signalfd4(r0, &(0x7f0000000040)={0x7fffffff}, 0x8, 0x80800)

03:37:28 executing program 5:
r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
write$binfmt_misc(r0, &(0x7f0000000540)={'syz1', "6b56c40329843b12c10c849c07a138e73630ea93caa96b07a837472412bc798459afd213c1f0fe16aab3ea329bc70e216a853f109d838129abac7dbc34a10b74b280c7ded39517b93cfc92660eee76cda090b134961ee979a69c20cd57cd2381aecd830f04e8c74fa63b3d505e13eb12833a219ad1678741df7eae9491171ca7874c955fde4c2bd29e6b81bd23d6b083587849c6442fdc52f66f99bc2811647b6cfdfde611915a9d0aeaa6c1f34baf345b72a1e91a3fd7824a7079dbf5a6d750d77c546605055f9669385e770df3b3bede97b2c0d0cc6bee05eccda3a873d4e77bebac1171ed06c20463a13f99255bb033ed3c8e5d53cb03bd2e24be4b7b40d379a3a88f5bb9ea47b5303db8d580e31b07e6c739d78bbfb5342e81be2a5b94cf7fa929c40d4e5ed6f550c3764604f3aa7e09002dc5dc76866e378254edd8858b80714660e2c6c8712110a97c90d5ef4c357307aa8c378b50e963f45ecf7ee9b0bfd083d2b8a928665fc1a2d7a8bc880145f4cb00df7e4ecfb27cbef26191bf26042d84dea532eff1b827bb083c864be4c649711c2eeb75ab29d3eb41f25343f95956adc560af762fbe0027f60537986201fc0d78d3f5860eedda2b37a328124c250395a14ea9f1e431f81dcacd9988a7fc37594cb2c7f26463a39babdaf9c46815a774c435bffe2ad95dc65b579cf3791163279a97ba7d8bc579c939aa6c756f0267fce038f2b723b7fd927c1a2e76959ca3013fb7d5b2aea357a5c92176c5b1bfb12027f1348e7798cea00b4002aa2d0af7999cb33b7a4e0b5c0c2c658825066d66bb220612308baf109f9cf0b1a244850a3b713b04f9c17f28a3740fe4555aa3fa77312fc7494d5d6efffc0008661fe0a9644d7b24b1d09ea7e5b4932241e2b017088df1de94f9829cae5aba6fb229ac433d2261275c9b9e36e4f0a948fbfe648d2844b245a5b1a8bb39f92f6920e4890b8a43e449281dccdece7fc329b8472f840c11619b442c4a2a2b894a8f3a9686479e6608d5ead062e08caee2ea4010f491973798de9990cfe561be818b7c1ce15e6eb9f41211f499721aef6dbb185f760f4a382bf15788766b3abd855aa1d0e2a451161f0f74019430d88823f27e4d11f10a0645176c1ce702cfb3bdd534a3487272f0f45d2293636571497e14ea2618b7080a8abafe7fb2ac9ca652c03959f4aaf51976d215eeb9d3ceeb1830841be72d9a972a264caff2bce078f5f3005c416b334ebdee7d7e7cde2c2a5795d7e6c9096d719cd9fba621611e2bb886ccc0ecb144ce696765033105f09c323ffa339bf2a420e92a987dab48b275c5989430726c38b47b3e968f149c1a09781819e0b50ddd43ed0db088df6eb5763b4c2afd3cfb85ec90af6af6a8081d8c1b0ab63fc30b254399f8c7a2f81ee8c9342ece075965aec5230e89c363ba265312c584d6738e24ce686b42d0f5c1691f26061d195c84881d2eb1004562a2a3dee697a6c7d477469fc011f4a5f9b1fba621ab997b856b3dbdcd377bcfbf82ada9ad823e4a4bbd36a7b0f287fbf129c1c9e5718dfc8a4051a0c40845c3f87be64712c7303cc0f08a2d0b2df5cceb4b50e9198ec621bfe96d516cddd4ef07988601eebaa4bf0e619224824b65154d1ce96c2c02c2e2dd63a621ac162806022d8e83b4de8d3a26a7d44ae09af21413d0a1e14ed4837f3dd663df25e3eb18a54fbcc1591bf3382ae99d677cc58cf3fd14991a11de38f989195b59689edd4e2fc52349987c2eda14448977cb25a9ec935763d7fbce346282012d876bf59466d9dc0e9211302c329582aa600bc8bf317e9db356bc33aa0ee1fdd1091891880faec3402d48df4e4d9e6995e9b972de4b708e2ced6d212e2c0e73dd4f75abe15685865fdd9062bb8d0c1ca2d69b67c74ab521412f352a9f1fa9b9762abac2e7216e0b192f84fdd1040cd4797c911c90bc2f33396ba1b39812e01207aa3d802f89fdc3d473db98dcd712c9efb269d9f9bcf1d64b44d7235eed3180528682a4dec87bbe6568811729db99e66d31dbaa95dab39fd4e044ee3881e41cc14a1df688ace8e2bbba12d2ef6badd86e8e057192ddd485c8b2b45a7834a35d385b56f94408d12a3ff0afe9c50203f78af7326344feaf4ef0dccf653c1b8c5813f2de3028daf184f49516f601cf54262217b103733fae8b51d42ba5609e9fce36269ea157d4ce99a72c6ed6135f1bbe41bf17c819677d643a7c7972dc8a4824552699236987548d1a47f82460f23734b776483d4ed9746e4f940b5e6a15f3bae2c6e4252a2b05db7453f5ba0012adce88df95fd92dce2d82a4035a2172e8894f2a72e9261f35ed2121f03477a6c8926b2c7bc3126293af869f51f751361425086bde9e4a9b93f9f80f9c6156ea9aa6828037909a0d0f23d884ad90f13b31bea863239216e8e569ae6e6a7742af8726f4acc7812c373f839cbd548d8f4af541a29db6bda6199755b87b76c591a87963582bba6bb0f9124ba966bf372cba265a918370e5b6a472c3dd1a5bb5c9f63c360a3f48dd1453bab9365426a9a763fa6b80647fa9d1b198f6b4dabef1ede8a883c35b3eb2a9455e968b3b80aa7d09d797717a95df416492ca1add2f8a84df1cfd29b204b4310fcdfb76516162c86e3f365bb226cdca327b6830160c43791ff979d1bee8fa457a9c9b93131869fc8e1107fd8a0701e0c409f2305731f83efb5981e7eab190dddd1818ac08041317489e0677628729d88abaf9ad5f958db03207ee5262225b12f5eda80cfb523653417632193e3c5602a0fdb0c6c0c48ab141f879467184fcadd9dc29005889a40860a0b7a1a874da89bc037ccada76e25af077844cd92b465965370c19f5edacb464b08e9bc046085848a50892318831c4d6589d3daf4e1a3361ee7001e1593f3de837f84abc1ea167d2e1d664d77145a05231714460cb98c7bf09f571e0205685381e8c0988cad2f32667f285963a2d0a9d394036e4a0da2f3c6971d7e7c3735c4d949e2c47a51731d0181d34c7c0c18fbdb0a157c6d25df1c52b207572c0625d630cdcec4b98fe778264270e5a0089affe4a0513eef6989868aa5d99f7fe6fb0e38daee4417cf8394315f9cd2b8a4a123acbd97ddbe65c077fd1afe2ee158c2f0f7db61ac0a484fdd353a4fd4c4702378e2e6ec0029e0573d0de7064ca2af5fda9cb47a3c95aab0bd3b70d4af09d015ac0f31bd41d6b973d1d6b9a1c1cc1d8186f257ff02b7775e1ed5f3f1ba66744974f1b431ec350e005577c7d8d4fc2797cf694f0f0514154f328db8cde7c58abeec50f3c95123d3ae897667e93c964f0909593e41efb2e61a26f04b260e8a5b1fefe9b66b7c3e48bcc0572116944cd56e720f7dad3a7da677e9200369c339d9d7988739edd6524b96aec895e615b7168357a294105d760a41f8abbe00b2464be4b05f6d0381afe4243c628ef529f048d837785bb8fb9ce480d2b32b52ac972734ecdd0a750e905bdf8074e8c5b3e8e52b85171179b94a9a09e82e801b5ff319eac18795f64f3caf9ff8a6ee6c805b6338058961be8c7047ed98dd30ec7a6b259e1572bb332556a287823fc63054f03b449e8c76a8e5b474411f80708e9b1aa720a205d87e222769a7bdf856c2a7decca960d8124714b1963910318334e51da83cb757feb62755def3edf41dbe55820610c8f7ca0d519ecb6f6fc1421591aabcff10829e0cd4a4177d6e97b2eb85e955a26bf7d2736fdcc4cd4610e1442e176923d3fce257a21c21dd95d021217e572db85a180ce5aec168c9c4cc2fe35e2a111ca76fb6da1c160385329703dc02b8af9e65982005902edf178abc8ae759cbc0f1abcc7cc903083ed7466ad1aacfe4cdec0e36bfcfef600378e001473541bf00e1078f2d8de7df29b65b9a36d7486618ef1b8f5659b0df2327c63b16d40d89f6621ca6dba0aef6face773db7cf6c606733d6ef60004bf4d937b8e2dc99e9f9925ff15c2454664b75ec3f397f9f6ff3dc98187d6684886a7746dcf7472b861702448b47c41270f508d346f737cfd6947c82d86bd23a4cd1059c2f5dc8ccc72697b320fab50ce40b129d46286204e1ae2c42f26881a0c44c02355361886d51fa32ca931f28bea87edd1a440ee9b54156ae398d230be86cb86c536a4d9e08e7091519094ee25d08826ff23f2cb66b7aae341a76e6b1a58d033029767ebe12675ed89e881c039c44d8eaa06eacd21e342f3a3301287ab747aa7f28f74ad394e3a9bb6573482496213bf6b24176e85dec584358839ba08a04f22121621a9be81e934ac84e8893d7089403608954303fc455612ddb775fd63c9276cd81a390636794955411e1656f90a6d45aaba1a78f82ce24177602d6dd9e01545d1abf55de9288de9e20ad73b5c1380a6fecca64c887ea4f08cded065182b8e2a1b177e4b13bfc3292f4949ef890ee5988dbf68d1dbd026b354097a29bc1584d311db6b6fd1e89cfce47cae6a4c72df3bf2eaa232f4c1da393a3a5673d703fb7ed4bc843ced2e99266908bda333d4aab5947870cf48aee19de11d35b34fcd4f1deb38141471636ad449c14f28549a5819ec1296944fcbd0143965b8f737808a531b150f001369d530e2fe3801cd3688715f9186c52eb1161167e7f2dd3588904ba7e70594787fd74eac73976bca0077753b965f69da1cd32b0616f8e2306e8ac8e1d143c8a0b85470dfa574162de7b6abd37534d5f483480a38ad1b055cf941eb45cf2d6e94f82b02ba7a490bdbcc8b8aff850979d44ab78f92e76062394e45fd1aa029e71517d4c6caea98db4477d865ade68475012a23009815595e9ec6a25116ab88f771650625c9264ec09e637448c6b9d5626f1fa22e74bae4f6f0f3e73cfb775d6a9474e622eda67b8d8327913fee4829719624f6c6bd163c5260443e6dbb60f54d41a22a13ad8c7e0403f0e723707168623f642789fad1eb4b6d14cdad5004997bb3e2e889463bf1a38f25523e9409a053157e5d6e0313bcbecd53fbbf1639821545b012a6a6460dd3655c77c43e634dcd3f5bb17ead079df03c0d131eed178785efc796cbacd650bd2fcf1881b3aef3270ba45b84836740e880c5ea462080ae73108049af3ebaf67d190c5465f2b444fc24292db33c7472e94afddea1ac99339b6318f73c781c14e0fb89845e926db4263c7b3ab28e30d7fca46be4a08fd6eccafe4a7f641eae7c42690c0c5d1b3124711463b68d85e68418b0a3b955f4cc07ce8afcf994295be6310a719ae60991b3e5d939656301ce0b83b90151ac475c934d31694e16100705b56155ecbc2d1442c12d78557e1d17b63a2988c4090eebe14a4acc610c06a93c27ce4c50b097f2379e3d9e1c22b3acafc8a78aa426eb18368d81bea4b676b0c6e0937819802786f8cac4275df3c3ec094da0a47a630c5277cf20aa300b4ffc3fe29a84170f2173abc741bfdbd02165cd883dba1233a6b2bf0690d0d53e82cb791e1f094749d7b745dd3426a1b19731882bf5b9480c4d0848cd7c0b77da36d3d04cf9c2731a380c031da846340d43610e554f7642763fd62664de80ec0a57f25705e46b17b815b4bce14e3644a81129b3c93baae7521c389fb9794f6660f7def26fe53c2eb8eafe35ec19327c9c7b89be2f8f507eb5963388c8fdbe00205d9aa9500b8176ff82cbd194675469e63b6955a48c13b6f367a61bb436239e1ea45bd844adadd19ab2d44e4059fcfae5c6fb902d1bb5894c37e56cdc0313b109d93f2a22f038ba827f1499dcb2887561dca3133734c1d5c4f12cd43a7cee3afb7041f"}, 0x1004)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x1400})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"})
setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000000)={0x2c, @loopback, 0x4e23, 0x2, 'none\x00', 0x2d, 0x9, 0x67}, 0x2c)

[  480.374912] binder: 20591:20598 ioctl c018620b 20000040 returned -14
[  480.385503] IPVS: set_ctl: invalid protocol: 44 127.0.0.1:20003
[  480.397770] IPVS: set_ctl: invalid protocol: 44 127.0.0.1:20003
03:37:28 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
ioctl$TIOCLINUX7(r0, 0x541c, &(0x7f0000000040)={0x7, 0x7fffffff})
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0x1001})

03:37:28 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000), 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

[  480.422185] binder: 20592:20605 ioctl c0306201 20000440 returned -14
[  480.451196] device lo entered promiscuous mode
[  480.465044] device lo left promiscuous mode
03:37:28 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a8", 0x1)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:28 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r1 = socket$unix(0x1, 0x0, 0x0)
connect$unix(r1, &(0x7f0000000240)=@file={0x0, './file0/file0\x00'}, 0x6e)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

[  480.487735] device lo entered promiscuous mode
[  480.494911] device lo left promiscuous mode
[  480.500079] binder: 20614:20616 ioctl c018620b 20000040 returned -14
03:37:28 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0xfffffffffffffffe, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008472714b8000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:37:28 executing program 2:
write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:37:28 executing program 5:
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0)
ioctl$TIOCLINUX7(r0, 0x541c, &(0x7f0000000040)={0x7, 0x7fffffff})
syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0x1001})

[  480.543248] binder: 20617:20620 ioctl c018620b 20000040 returned -14
03:37:28 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a8", 0x1)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:28 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x4)
getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000000c0)={{{@in6=@dev, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, <r1=>0x0}}, {{@in6}, 0x0, @in=@loopback}}, &(0x7f00000001c0)=0xe8)
quotactl(0x4, &(0x7f0000000040)='./file0\x00', r1, &(0x7f0000000300)="dca3d52c90e174a54a8e21e1742bb10556684d1ce415122103bbaa6300241e2b19c06756fde46fc4ce8f89d9b945708b55ff9cc1fb6151a4929fd41447b0adcaeb79501f2c4f9b2603ff9140c6a8e58fe04b8377dc8ffea16e26051c4250140630b5d8838d9c3c4b9623e2d4f5a706cdf3817d7b520dd3f165dbb98ae27eed804f40")
r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r2, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0)
sendfile(r2, r2, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, &(0x7f00000003c0)})
ioctl$fiemap(r0, 0xc020660b, &(0x7f0000000480)={0x2, 0x100, 0x4, 0x1, 0x3, [{0x3, 0x4, 0x3, 0x0, 0x0, 0x2000}, {0x2, 0xc574, 0x3, 0x0, 0x0, 0x280}, {0x1, 0xfffffffffffffffa, 0x7, 0x0, 0x0, 0x400}]})

[  480.624795] device lo entered promiscuous mode
[  480.647793] binder: 20635:20640 ioctl c018620b 20000040 returned -14
[  480.655661] device lo left promiscuous mode
[  480.689197] binder: 20639:20644 ioctl c0306201 20000440 returned -14
[  480.709471] binder: 20639:20647 ioctl c0306201 20000440 returned -14
[  480.735948] IPVS: Creating netns size=2536 id=117
[  480.977116] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  480.991438] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  481.050489] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  481.064673] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  481.123261] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  481.137817] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  481.152102] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  481.169440] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  481.837151] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  481.873377] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  481.880094] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  481.888569] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:37:30 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a8", 0x1)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:30 executing program 6:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r1=>0x0})
close(0xffffffffffffffff)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:37:30 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:37:30 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00')
sendmsg$IPVS_CMD_GET_DAEMON(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x21408044}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xb8, r2, 0x600, 0x70bd27, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DAEMON={0x28, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x7}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x90000}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8001}]}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1541}]}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10, 0x20}}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xfffffffffffffff9}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8001}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8}]}]}, 0xb8}, 0x1, 0x0, 0x0, 0x800}, 0x20000000)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:37:30 executing program 5:
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x4000, 0x0)
setsockopt$inet6_udp_int(r0, 0x11, 0x2000001, &(0x7f0000000100)=0x1, 0x27bfe992e66f2bd1)

03:37:30 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x301040, 0x0)
epoll_wait(r4, &(0x7f0000000280)=[{}, {}, {}, {}, {}], 0x5, 0x80000001)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000002000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r5)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:37:30 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = dup(0xffffffffffffffff)
write$P9_RUNLINKAT(r0, &(0x7f0000000180)={0x7, 0x4d, 0x2}, 0x7)
r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x1000)
read$FUSE(r1, &(0x7f00000030c0), 0x1000)
read$FUSE(r1, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r1, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000d00000001000000000000000000000b400000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000b7001efcefdf0358543c4a9bd0e8725d7f4a70f3eeb0bb6b4cbe772989ed8e2790a932b1302acad7c53f76192eca40b166ebbb9264fea001127a454c98da4cf949730c"], 0x90)
openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0)

03:37:30 executing program 7:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
acct(&(0x7f0000000180)='./file0/file0\x00')
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x200}}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
r1 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0x0)
keyctl$clear(0x7, r1)
signalfd4(r0, &(0x7f0000000040)={0x7fffffff}, 0x8, 0x80800)

03:37:30 executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:37:30 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a8", 0x1)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x10, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

[  482.958766] binder: 21028:21038 ioctl c018620b 20000040 returned -14
[  482.977515] binder: 21029:21034 ioctl c0306201 20000440 returned -14
03:37:30 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
llistxattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000480)=""/4096, 0x1000)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})
ioctl$ASHMEM_SET_NAME(r1, 0x41007701, &(0x7f0000000040)='wlan0selinux/$ppp0\x00')

03:37:30 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a8", 0x1)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x10, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:30 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a8", 0x1)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x10, r1, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:30 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
ioctl$TCFLSH(r1, 0x540b, 0x5)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:37:30 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a8", 0x1)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

[  483.091936] binder: 21053:21058 ioctl c0306201 20000440 returned -14
[  483.100450] binder: 21053:21063 ioctl c0306201 20000440 returned -14
03:37:31 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:37:31 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a8", 0x1)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

[  483.208905] binder: 21069:21071 ioctl c0306201 20000440 returned -14
[  483.220776] binder: 21069:21079 ioctl c0306201 20000440 returned -14
[  485.989221] IPVS: Creating netns size=2536 id=118
[  486.022472] IPVS: Creating netns size=2536 id=119
[  486.747162] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  486.766217] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  486.793706] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  486.811926] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  486.882547] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  486.906337] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  486.945226] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  486.963661] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  486.992312] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  487.012317] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  487.031368] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  487.050467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  487.060769] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  487.079403] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  487.099005] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  487.131767] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  488.144359] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  488.199405] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  488.205555] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  488.213158] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  488.221034] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  488.275530] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  488.281752] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  488.289083] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:37:37 executing program 6:
r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0)
ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc))
clock_gettime(0x0, &(0x7f0000000200)={0x0, <r1=>0x0})
ppoll(&(0x7f00000001c0)=[{r0}], 0x1, &(0x7f0000000240)={0x0, r1+10000000}, &(0x7f0000000280), 0x8)
ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000080)=0x80000000)
r2 = syz_open_pts(r0, 0x0)
ioctl$TCXONC(r2, 0x540a, 0x0)

03:37:37 executing program 1:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a8", 0x1)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040))

03:37:37 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)=<r2=>0x0)
sched_getaffinity(r2, 0x8, &(0x7f0000000080))
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:37:37 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x1, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
ioctl$BLKIOMIN(r4, 0x1278, &(0x7f0000000200))
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="030e004078a37048d9fabdbe2b6667e313000000150008001b0000000000"], 0x1}}, 0x0)
r6 = socket$packet(0x11, 0x3, 0x300)
socket$nl_route(0x10, 0x3, 0x0)
syncfs(r0)
ioctl$TIOCGPGRP(r5, 0x540f, &(0x7f0000000340))
getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000000480)={0x0, @multicast1, @remote}, &(0x7f00000004c0)=0xc)
getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000380)={<r7=>0x0}, &(0x7f0000000400)=0xc)
ioctl$TIOCGPGRP(r5, 0x540f, &(0x7f0000000500))
r8 = syz_open_procfs(r7, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r8)
getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000280)={<r9=>0x0}, &(0x7f00000002c0)=0xc)
fcntl$lock(r8, 0x7, &(0x7f0000000300)={0x3, 0x0, 0x0, 0x9000000000000000, r9})
memfd_create(&(0x7f0000000180)='[$[\x00', 0x1)
rt_sigprocmask(0x0, &(0x7f0000000540)={0x1}, &(0x7f0000000580), 0x8)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:37:37 executing program 7:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
acct(&(0x7f0000000180)='./file0/file0\x00')
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x200}}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
r1 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0x0)
keyctl$clear(0x7, r1)
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:37:37 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
r1 = open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000240)='/dev/keychord\x00', 0xa8000, 0x0)
ioctl$RTC_WIE_OFF(r2, 0x7010)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246557656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000017002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000e1e91d6a998ca150b33a6074327954c85e975a337f3c997d035c5bffdaf395ce71ee2dcec03eeed1a8bb11c3459039b048157d1a8ffc32559a42cd8223066da8106a010f0fa8a442a6210e2d658869a98ae3312ccfafcb477ad038eded5b2acc8148e2d52bd29c18f3586cf3b0e2a555c0d385bb954853aed63b6c137ba38a1b2b9ceb1aa15ba48f8516bc8ce40757533a817873a6453972b67814f7fa7bab10c98adb8dc000000000000000"], 0x90)
getsockname$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000180)=0x1c)

03:37:37 executing program 5:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:37:37 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:37:37 executing program 1:
syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r0, &(0x7f0000000000)="a8", 0x1)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040))

03:37:37 executing program 1:
syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r0, &(0x7f0000000000)="a8", 0x1)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040))

03:37:37 executing program 4:
mkdir(&(0x7f0000000040)='./file0\x00', 0xe)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d6f64653d303030303030303c30303030303030303030af9667069efc88c734303030302c", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'])
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x8, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x2}}, 0x24f)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

[  489.544280] binder: 21834:21840 ioctl c0306201 20000440 returned -14
03:37:37 executing program 2:
r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x800)
write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0)
sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:37:37 executing program 1:
syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r0, &(0x7f0000000000)="a8", 0x1)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0)
ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040))

03:37:37 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, <r1=>0x0}, &(0x7f0000000180)=0xc)
mount$fuse(0x0, &(0x7f0000000240)='./file0/file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000680)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id', 0x3d, r1}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x1200}}, {@allow_other='allow_other'}]}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:37:37 executing program 2:
r0 = accept4$packet(0xffffffffffffff9c, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000080)=0x14, 0x800)
write(r0, &(0x7f00000000c0)="74773cd4e6732515a7d779566210ab48f5b93df03b448b8f5a64fba5d084b9ed63580c9c58b53f3fb8096ee0803d", 0x2e)
r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r2, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0)
sendfile(r2, r2, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:37:37 executing program 1:

03:37:37 executing program 6:

03:37:37 executing program 7:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
acct(&(0x7f0000000180)='./file0/file0\x00')
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x200}}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0x0)
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:37:37 executing program 1:

03:37:37 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
r1 = open(&(0x7f0000000300)='./file0/file0\x00', 0x0, 0x128)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
symlinkat(&(0x7f0000000040)='./file0/file0\x00', r1, &(0x7f0000000180)='./file0/file0\x00')
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x7, 0xfffffffffffffffe}}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:37:37 executing program 3:
openat$autofs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/autofs\x00', 0x20000, 0x0)
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000800000008001b0000000000"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r5)
ioctl$TIOCMGET(r4, 0x5415, &(0x7f0000000280))
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:37:37 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

[  489.785257] binder: 21872:21876 ioctl c0306201 20000440 returned -14
[  490.011714] 
[  490.013519] ================================================
[  490.019301] [ BUG: lock held when returning to user space! ]
[  490.025109] 4.9.124-g6a1b592 #30 Not tainted
[  490.029513] ------------------------------------------------
[  490.035313] syz-executor4/21889 is leaving the kernel with locks still held!
[  490.042488] 1 lock held by syz-executor4/21889:
[  490.047148]  #0:  (&fi->mutex){+.+.+.}, at: [<ffffffff8193d5c2>] fuse_lock_inode+0xa2/0xd0
[  492.787796] IPVS: Creating netns size=2536 id=120
[  492.819095] IPVS: Creating netns size=2536 id=121
[  492.844566] IPVS: Creating netns size=2536 id=122
[  493.115715] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  493.141089] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  493.197254] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  493.204976] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready
[  493.213813] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  493.228829] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready
[  493.245811] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  493.270572] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  493.330171] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  493.338451] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready
[  493.346579] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  493.355343] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready
[  493.403765] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  493.427848] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  493.449689] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  493.463046] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  493.475601] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready
[  493.485709] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  493.492786] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  493.501172] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready
[  493.515900] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  493.526431] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[  493.543707] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  493.555700] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[  494.774948] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  494.825984] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  494.833008] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
[  494.840463] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  494.846784] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  494.853919] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  494.898939] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  494.905067] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  494.912239] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[  494.920609] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
[  494.928282] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[  494.934982] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
03:37:44 executing program 5:

03:37:44 executing program 1:

03:37:44 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000040)='/dev/keychord\x00', 0x2000, 0x0)
ioctl$RTC_WKALM_SET(r2, 0x4028700f, &(0x7f0000000080)={0x0, 0x0, {0x35, 0x38, 0xc, 0x1c, 0x9, 0x3ff, 0x6, 0x49, 0x1}})
r3 = gettid()
r4 = getuid()
r5 = geteuid()
ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000100)=<r6=>0x0)
sendmsg$nl_generic(r2, &(0x7f0000000180)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000140)={&(0x7f0000000480)={0x1bb8, 0x13, 0xb0c, 0x70bd25, 0x25dfdbfd, {0x7}, [@nested={0x260, 0x34, [@typed={0xc, 0x82, @u64=0x2}, @typed={0x14, 0x6d, @ipv6}, @generic="144b0a9c5c1e39d0d6aaf0b7615e999b7dcdd9d32510d9a9a5af2bb5b7ee5d11c371268accb85515949e05e13eb30cf614a995daf13e1b6e92c297ae8273a095408a6f299e13e45e7bf46d516430be47356892", @generic="b26ad939a6529be582a4901bccc505e42d77bbd38a3c59ce13d65c229fd4d2b1dd9c0db36681d48d17a837ae19db6fb5e5581f9afed8fb55751d1a999b3861ed60bfd11d4cb20e8ca81888a271e04717895e970d4fc8cf4ab57394037557ceeed4660dbb9d145c1aa77b85a183bc179e74d07a59fb0b33c47ac407fe7477a1574b66c59ebc4c68192ff2b48e8f13c9a3e1915de575b4cb023359dc848b12affd7043fdbd401a21f71dd28a2c85e76fabc5504a78c449", @generic="1d510a0ec08c4569d8e64a07da15af36a15baa5907556591ba3258c3bd3e6fec5146a85572ed5045fbb52da171395ae809b8b48305d93ad08dfef52880d28a98a652cc80f59135e444e6fedfa69cfada4fb73b2762fb75fb702ff9039cb7d445d1d205920999ec57538d63ab0393bcdfbe1e51dbddc50df5682b68186226a512d1959b072577c86b2597d7a36db87c93a0005c681ef0174903cc9f120605d1342f23d5ec0d5fea4b7a10bf53b086f96ccc0574", @generic="92989d9fd23c47a09fd4387468a3759b8144abd13890d59b254d60806485e06931c333626dd487f053f75ff4a714e651c0a0cb62dcb54e580420ade8f1a3e341df00549c87fcc05cbc5a25ba65bdeee90ef8714c7fff6f6944ebc6e6d17d4cc98902a6ddd877efa5f2ec8ff85ccc9b261b44389609928e06e981d4fc07"]}, @typed={0x8, 0x3c, @u32=0x8}, @nested={0x128, 0x30, [@typed={0xe0, 0x72, @binary="14ca06baeed7b640053595581d910f4d72d41ea01f5aafbb8a15e50943f98f5fc1ef01ecf19244e9b79fb2f467b42bcc1be17b882bc2169bd6c63a525b05c5a6395b26e71a0529089d76c3c808924479d4a282233d72f1adeb8875c54bef9bf1f18d61074d9afcac7f99d0c9eea549ac295b2ea550065311d4b7470ce78d44122b81d96445d0108c2b114267fa1b9ce7cec9f19450ae1fe313986c800165885bfdda1e37d9b2a484990d78b5b05e4972d116460d0f399c58db0438e0c63e22d58c5edf73ca488b3333e408f2c45b481fa414f0c7449925df08d5e5a1"}, @typed={0x14, 0x69, @ipv6=@mcast1}, @typed={0x8, 0x92, @pid=r3}, @generic="4a882f1391ca2f14be1c40660d09a2372fb7001df5227da2ed04f6b1ccf03bd7f002779965b2"]}, @nested={0x218, 0x40, [@typed={0x14, 0x10, @ipv6=@mcast1}, @generic="439fa86ba8eab90506ec6f7a7e5442e9256e6d8d1edcfa56dc1da00de5f9abc50278c57b032ff43feecf12b11d410fa881315948cadef934dd48e0ef6bf89e8f685f57ef1ac9820fb91fc3590d68687ab7e689dda8efb3bbdb97a7713be93dc908beb142c363398cff18cdbd3462b525b448c88f55ee72e74549552ff7", @generic="7e06d97d298bd6c7046ab3e5e04c813df8af3dac496ab4be57d109b0ac5b1d2658804589574a3bb2516747", @generic="2015330034da48316ec157dfd40f7ed25a1662b1e72c4ffc", @typed={0x4, 0x40}, @generic="1dfd9fc2a0613e1bafd052f4691e01344de77f25247fc67ce557bfdccad04dcf12c080f73c265a8b711ed8ac4c623367e70bc59bd0c3861ddd90d102fb5297ca0924c97a90eb", @typed={0x8, 0x25, @uid=r4}, @generic="9c39b1fb97d0e30c137c67140d70320ccdfc99bd673a9d415a3dba24df35d181afe1552e1b53bfa346959ef035a7ee1c24033e41f139e5e26e95ed17017fc17665f1db40cc86bad508dc0e2f813c0b30250fa0ad290d147ef0e06375a750a2c9f3d8e2c54ecfc82373380022331004eb345d55f440bc253a8d7de03f30354f80bce748379ae83fa4f3320a7c42fc970154fb33ae9f80363fd08d6c9c7616adc12356f424db67988a986f3d728b5a74610ddbb44a1a7e961fd21ba95b7f366ba9c94fe2b45be72e794a54f1fb6fed6818eb5cee2ca47de858bd6651c82d99593218e90258", @typed={0x8, 0x78, @uid=r5}]}, @nested={0x1f4, 0x13, [@generic="2bfeb225d43a33d360087ddb8dc3d0dd85966829ecd288d35aa6782f6ba45e691524bb26112393eb36acd7edc10f964f64852d25f4d687fbaa5d4b9c8a5faf25425f0d29adae7f58c1dcc4710ab70f65bb222af45406478aeaca47cbdd4233594c3fce91d10771d8f27725beac5697bb9a678241411d3de991a582f21fe68c1e6c54ae143c7e1d6514ee495877e6a27138be86f007e9ddaca2de8031234a0030fab679af7b772ed524b2b8d3", @typed={0x4, 0x42}, @typed={0x8, 0x77, @u32=0x9}, @generic="00d390737b652fe2c7c7f0a763fae43e79b4fca55942c2228138008fee617ec519c67ebd309d3c182c8d2f4cb43f4859a256a812808078f5d9b7b625bd0ad8fdca9ea8fb96f44077c8dace04193e583408adeffc01b14396596bed2706b7a2d5a36c66f826a8cab9f4874394d35d86c6531db79d8891d31c6d4216ff27f0291ec5b38115171a4a46ca5e91112cc90e6adf7aece654e347f401f4d3258b25e9549d67315cd94e743f2649d98bf80ca4b2322f324a9de127186b7cbcb05d95dce03027437227c7d4", @generic="92ef067663ffd3aadc605af6a819d62a9ac6bd8ea3b2b47fecafb35f5631560a5626d9898badc605162d7b06936e01b2071423cac67c045b6182a6b8295c6f1f393f1421ad02557db3d0a4b0b4b09faf1027424b398832abbf79e855dac3767c6caf2e6e98be96a7331a34474afe3c82"]}, @typed={0x8, 0x76, @ipv4=@remote}, @generic="02b46b013f3ba0f7d0e648047acc60e94017bc835f016cd17e5c9feb6bee195b82b65a1acc839ffa920abe2f25c001fdd2de899bb0dd0272132051d2ee0ce8b08cb06251f67574aac92187d5f350c776457d83664b5f9c6f735c5679a925c0cc8a6a1ec0f814f843fa16969d0038b78a64e26febaf8cf7db5f0a1cf45934308c9e99a1b187e590873e7bc4ced2d6ec17085099409e86ce24dc981be718695c633c011eeecd04188d7cfc4bcaf2e7b9a271249b282e4a617d25ecc3c28312c22ed684f4493160b45822864d806833d696b01d3476bd3186c1f09e", @generic="4621ed6f25a017111ff7dc67b2dde3c3e886d579f02ce8265c44bd714e7be80bd95524238b587d5381acfb3352853b400e16b6be4d88d0890703a1cb615ac369aaaf28b131bf1f7d443fe6867b02f82e2d109a948345487c4b49b9c111c8eecc62d92d8a022b3ddbf837a4c8bc33d2536702c16743d51f5ccf723f49721d1dc933c78f5013829da4a494a51c6359572aedbb1a38789225789aea9cb0600fbd45cbf1ab11a776434936524bf916a7a5852c519dceb598c9", @nested={0xe8, 0x4f, [@typed={0xc, 0x101, @u64=0x1d3}, @typed={0x4, 0xc}, @generic, @generic="d3fc94ac573661a4ab2b2daa923552de0e41e58065f875483ddc1907430d3aec2030596bccff3022605ff71709ec5da5b4d1ac5b", @generic="42191adddfd0160571b1090ac2877bf6ef9e4857d72a9f7b481afeb05795d52bf36a6b85d5f78c9cf13609581f7e31fe731e5a4ed7c158016bb7cd719246f4ea4e09f18617013273b7150adf61f42bfc36176015b00d565359b3cb29b65cd7d0ad48420575d344155bfdc74226927697ea2a1d08a70d97e29e11761302bc4ec44543483dd092935ea818957da66e90347d", @typed={0x8, 0x61, @pid=r6}, @generic="8f3e165bcd78"]}, @nested={0x1184, 0x6d, [@generic="630af64128958b2ce8c777d11ebe0cf953cd8b4c585ccff18bc25c", @generic="2cae5b9ec94b8f95d538c9c74c44bc376f9580604433cb4c3455e469a084acc1", @generic="f187b418997ec39cf936f7b962be424ea8a61f5479fbbc8b027af9454fd32f2ef6854aff09b1cc1edccc74d1dcfc722036a5153e5fca011ca30a6d4acd77f8faf7f5aae944950bc97477d96a20639334247029b8d3d4de6b7643e958d0fbd27b2ddcdd36d58c3c84a0088aaad505afff7c3b9818dfc3ff0052fda3cd1c5e9e92a38055df419952ce39662c1526def7fd8e04b47df256ddddc116db0faaf2d2578e6e5c5c97567553c6b5d91f1f57f171219f1c3dfdb42f43212350625fb056a53f95df5eb7f240e476b797a452ba4b38c6634e6b1551a565615a9c49b9a8a8a9b4dc4891234e7b0333399f7f967278a772466ed1bce773077e6015e66d3bc6d03ff11f1ce86aeccb7ecb678d59b168e5d56ff77e77f7dc1cac1fe00b70bb7537fd00cb37bca0dba8d7b20f2d184c67dc862ce6efaa34df77b1111e53e01ee1f2862f1a5d7b3ce30860b144596bfed064c7f625cc49a48d23d260d47f1ef20fef8886016cd1edb2bd3b8d495b0ada069402a9d2ccd51de413af4084d2c4d3b5069452678c834a48d5f7df99950425b6bd10d57ec9fe9ce72a90926898ccf3508a4483ee0286e4dcf5def3899224b4d1334bb96a9373f86c26601d0832d3ea81a7cdf970ca853fb9a4176539ab6026f37d37b62cca89d5fae7f10e9935b5c9cd4ef4152894af5d8f76f8f4b845624f254f174511c6d9ec12059e7760bfcb3fd8e4f15cdc203f98c5c13885f054fdc8083e92d4754bcd7ccc21c47d798d34751573dc16978d09a4e0a3937d3e9e17690f42c249592707ad2c9e040e122f5ac6a806a5d2bc7cc4e3fea6c3f5ce55c2769e4237bafa6792d0204da9e45d0513b10bc2eb7b0ebf4b0d408659ca1a373e6141b796a7db7b678e79b43834d2982e3908fc1a4ca8db7ea23cc0df231160cf37f3ebabaa90c6568466ecdf642a670cfc1faeb3bbbec35e0a655ca16afc89fb5f2874fa6e3bc1d7644f5338c84c5a8ef72fff0f29f0401faf7c0c2febc7dd3782e9fee26511508d853f0ca2ba33550afeb896fe8c966e63dca4344e1e23c014adc75c52a9921bea8c3b508cd404633734a6b3be74a1a81c4e3fd9bb77968017bcb0fa840e99dad56fdce6e589e84f05546d48d372332d3e0d6043d95c21cb4780addcd72a82acdeaf0a41fe30c7f847c013c41f0bda7d7683b05fd8a38da9a2d26d1b4d14a3786337ea7d07d9dc3b908846dd3457d7e3d17f9b9e181071b6b77c96e031e3f986b6272aeda53ad58af2b3983eb861df971b433650674862ebe596158e29013c53105d19eed2fe76f27eb12a7a1ac6080b02398dc79d24be9565dd61e6a4d8870868eb2d38bc76e91b7b0a4fb1fbfcda0dae89228ae181235634948c32a9e2f6c65e03c32b4db3bd8cb1ec887d5149f1949bd65a37ec3c4f387bc1bcc96b7d56940a4b0635c6b7b6efb364380bdf40ab19ffc7821944166629170968f26d290715a18974a0f6c4aa696a99647df3f5d91f1a8e14f34c1e354876f8d1a5fe003cbc0239f551517391d79414cea2f100bf310a6e260236b67529476d102b0930d1b36988894fd7386359e87bb75f772a35e31128f92203f82dd90499c7d9b2a9a2a45f9ea1601c919da52bccef72f7c971032b97cbbd6ae4d9edf401f65b871189e74548e23b5e7a78bdb18e9cbb61e57e00360e04dde4a05339681cf46134152d9adc238736abfa2ad146709f4c62b397d215a8718702d7ad277cbdc2e559d677429c283e5bbfb41a52903c91a77f51be74689bc4a34f5f148dc4a5d83428e110481902c33a9b16a35c359b6f6f842a40b59e70a7a89fc240b14fdcd832791b02837e4f1bbae19070f5204709781b5e6927c51d95a38bbea2e2eb549846e3044566a45a9bb6ae80733f472e8ecf32946e9f98a76d446f7433a6855b71204c841ba9be45bfb2d63a1aad5eed21ce9fabd9ee02a96244c76db97b1698753c6e10040a53ed0fdeabeb47322d72e19a4be5d7e0b1c0e17abc3e5de525d9a8c79d797550b335d8c9ee31dd20ae07c61567628fff6af6a8badfec231a901fa9eacf055ee138218c0bb6c0dce4c2affa28b80bf8ff1a77c29f471cb1e14edd51d1305b3a4efa3f9517c1d861a0db15fb7b47386e9385d378a5a3229f00e9a5cbbaa8bba5cfd1828996a1c551923eee1ff3fb30ed1382a6c9605e59ac0939968114470c32a8a1cba8641e89ddbcbc9e8dd32f5329b10ca0dafc3c05e7a489ad79b25a1124c82a8949e356494b53ce74d2e990d599e03dff9187f3feb8ef0004f8fa4d882879eb9fdc33fb2664e70abd675061f79d1b71405f03c93d6431b7c6e08ef7a7c07a777749580871d723157a16683247301e9967e15bfce134be2aff17df9b88a2da1aa61132ed4e15f1faf47c9ac75caa80bed9380f80645b258dbe32cf453816f888f3457ff343460c95477e201404e86f0a31438f03e39ae07e8988add15baf589dbbd8df31e4c2dcae3e50489aa15f65e5c5fd00fc9ac655a2d170838dd01fb3db670ed71f1bdf518e86602da027bbdcddd55f6d36f5ffb9af3350540829cbc93609dc745b892bf27ad9e3e3c7dfdf48511352ab3bccb15a797f84e6aaa695c6d94bfb99b0575877e11a54f90419858c63ef2c98426bd60ff8a7a9facaa01eb2e2003a2d9e965aed8a6f737c248d3dc6e993477bf53bd8b3c3e2efe06c647a1b6b8cfa419339328579c03efbed61ce86970d1ad517ab53c378adc1fa6d78aed579341d8fdb70207bedb9cf497309283b8187ea81a721f49a4d6b15c81ee20668c67d8c0e499a11b913af8cd27a1f2718a1ea380decacbe5ca50a84ed31180e3b5d190fef7a4b16c8535f24d492a93b61187e36941d8ecae8b65705edc110f1129bbe8eeb32daba745d68e7d7e51cd08aaa8421eec443356f7037703032fe08f3fd6ae1162d13d9c168aa5b09600028e540f9a823910d6b7acfcbaa133f022dd988e72b13849d6d8c6f75facc1e183a1b9952f09fbc5057411dadd5fdb4a9e8570eec85cd5e94fd15fe189aa42ab7b3a058ac6199874aa094830c83bb885736df9291f76604d3f7945250b61e34961587bb458937477adebc32f273990c1129f90fe0f1711e62fe22384a9752d00659ecd40abc118e945f217fe5b31cd29c8313da5dbae6a70b09ff58b4bb76c0bbfe78a82580554caecbc97ff33e837a3b999f8feb43407ec4d0d3d7bc73b6346237a7a23e750bd0af0a40c76b3ebf5c358356082ab124e33380c4dd32f1cc4a6c90b0ebd3cd0e508dff48328f382d10fb14587def0315310a4fcbb7ef5884351a6e132540f9e5f9c8f3574bf1572d641059c5a119d8da0854ea19b81f1444b59e67129e86e727ae4af30f5edff8879c3ecc1682a82910ba9ca1e5c77eda75247086c62d6e5abcc25d4dad484e6da2cdf581eaa93520bd22b33d1a6d67f04b9a67a088f2e53d3332b62d7114d73760c5ca5cefd2b7df3a8e9ff2c0d786eb77b2929e8ce93b7933dcf572f7cae14562f2eeb83ced0f385ba7e881e991f361d8aa10626ca622d9b0217fbfcce2479528db3bd66905a367148f7f33458abeee2be548c131adaac05bebd288488199b6e02fe237b0dcc0ce517bf12bf7fa97b4b2c9847104ddf3ac5945d7cecd2ff2fb10af51d4562d77e216a8614712f7bf62b34c3814b643b5fcf0c1f067f4d63cdc8a9d4356cb2d34307431109047b76fc5ead6a0717244d7adf668d23ca071be0dd654a7b003d02d721a0268be507845b7dda36cc9769aa496ee53f00c121d37ae0c742c6483300f8488cf9c1fb657a357cda3f6dbc2e35258b1ca8d2d0de6187a2f4dc841286f1df9c1d0a0429ce60ea3557900e5f541c3569b8be6e00f6dac83a0219aeaac796e08d7c7da0a701064866f19a68f11e84ea8bfa5487d05f515afea30e0eff5fe9e88dd841914111d9866c9bef0c292ae8edaae8e6d3b6538fd57fb3c0e42d0129e1cdfbeeaf5c09318eb87e688ce0cbb99d15ce5da13aadcaeb3874e4c984b6198d954644ed62682eb68bbcbaec97c7caecc2ec5742bc6053543dceee5d7a4a187f67bb491c43fb049f311ecd4ebf909a24001233b5158b2f62f221f59f6799cf6fb9029e8961ad3638a5742e5579cd69d3bc2a701b1f1e0b072c7d9b8c546669db9c8f8a3bcc40275bce327e24089c429f47e50c3f46aa8afd0bcddfcbc7cdbbc2c6105b4a7e62dfa5c30ceb5dbdfae5745a70bc3afa17cde963f944616689e6bd311372dcba88e4822a710a761171bd42bca34158853be7d0754659b913846080ccb73e262eb6ce5604a52d069e1db3bd2bb93b18a28e854f92b941bdf95498ec9694e812d13ec2375098eda9b2c0b8bd2f8d430e1bfa2d87ade769fc4bb1bf3f4794567c4a49e3e875d97b1b93f6d3a48fad4241bb86d171343f6a217ce20e4c25badf8bab585f4612825af17854e62e2e24e3cd945d8672a22f32385c8bad8f4bbf34e324bef67a8f9a6905dd36d494f4168f7b6c60cce733aa8163c8513b8b4e424ee14a9b04263bfffee6e09fc638d7bb85f979200de0059277ead6dbdf49d258ee10babda6e99a75c4f6f005489b29533425518a43ad0b1d77fb8ab0c20714710ca1327e733bc39ac5ebdb10d34592601433fe9e03d5597d4742a91269f5cfa6754ccdff7164aaa4a405d748b9fbad658a1f04803e715ae1293f8d8ffd4fda35bd64e70378baa732b7a102158a029544f2f909bc06fc496a47887159a14629ad3dfa0f2242848948405b0ac0ac4b39ac2c26cb9b94d29b73e86a7b7ddf618cc14e8353851d4e1d234b934c65dfa9251c9e95df2b2dcf09d36687f2a236a41a0cc43fd6d5ec4ef11abc23041628c34d99606f90efaa2eef7453edcbf6b469db48f3f1d38b1758a3ee87293b833e0e77a594fb51adef41e51a4d7921090f3df420c7d9f48dcf4efec2e1377b710fdf6c160e039bda10a90b90052c90bf64f1adb7eca5c287b2f9212962f1b8f4948e31949c1bcf4d859fb96f172a4244ec7fd52c9bd07415f9c217c7914fdefba1b1eacbe5bbf758fc8d228a706bc3831b800bf8b00871d436017e364ed73a730447c09660a78ca4fcdcb3fb942e3ae8c2bb161811bd71fe4e217d43e0690a2e9c6df97b05b325e6f2b7cad2f153ef7b5168f267d24aed89f1a977b87a86882f3b0b1ac7e9e111e8d4a0076ed144e7e542664e1d2f7fc4a1528e67e78d2948bb5f56315d1ae039f45d9a265b06f7e4b3456067a405baa974d810085a9ff7d4afab44171d8abf88b4fc5b981e00040b39df53c947213043b0e401c4401bc5ce17273d52d7ee6c377b00616e310b4dc328f04b9e90f932b29244a03374a5e263655469182d3349168f7ef693b29d2b42e48fe2d07085d6a6d363b18fa84607ca187dc42b6b2615008205ff648fa2782bbe35840ad8dc90799e3286f2e77160710c1e34d3402e0182c571312ef621d9980c8a18c8cd47a325ffd0c07789d76f3f0e3e652b3a5c004b85c3979ec486997b74245c146eb7c3b2a75bad6c7ed8c8ac9966fede7c76d6db1bfb4c9aa0f80806857f1530c83cc0f48aa37bd2cf0fe35a61e7e7ab3106392bcbad9bf8bf7ffe82f9f189037f471a128c78d6e266a611c880fe8f0c83cad1463e576383f0c50b75b401381555a0ee3495f3198ed3a15c69dae3047057ed005b717fedd53ac81e6804cb314a2717c53213b9f17c1a640f53ebec4de50ef08a225cb13424976261e927cf2fa21c2f16c43de812e51adbc8be70f2f788656be774961558dbdd217700c95661e4f3351aa2dfc104b25", @generic="92b9da19a18dc787a8a474e170814022fd60dbbfcbff5e08945bea26a81e7eace2c8abbbd54e906e0bb9f8a2f8eb429a42b8e1381c71ac0263547db5f301465852d261f27fa1aaf2caf247e27dceaac5bb82962f78e74f8ab012d7982d978328b1acd3fab917fb965f167676776ed3adc2d2d0dffbcee782769fd2aefd9187a2d1f57eb0409227d01053443a9e3ca858d19f9f0e6eeceb85b47e7df2c0e775d3aa0bf2c0fff36b2c719460a7860188931bc3131119fc7a1a1bdffd7d5626400c9c76b0c9e551751b99fbde04c831248c2a94c43e1fab99a0efa7cc98eb48f4", @typed={0x4, 0x24}, @typed={0x8, 0x46, @fd=r0}, @generic="f986897e998f7a2ff8e2806b949d35f6c95a3413f45cd938a46f9773c32934b9f0abf3a7ac2bcea8777744f25e92ff90c7ff83c4254f7bd3adf5e1f6b2c332b8fea547d2f3275967e4221efa97ea7dc1b523c24bc6b01b84023c"]}]}, 0x1bb8}, 0x1, 0x0, 0x0, 0x10}, 0xe0dc9744904c37b0)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:37:44 executing program 7:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
acct(&(0x7f0000000180)='./file0/file0\x00')
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x200}}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:37:44 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = socket$nl_route(0x10, 0x3, 0x0)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0)
openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="030000000000001c61cd1be55548299e426fb5c98a40b354eaa5f8d7bd079e896626e81979e0b1f7f574"], 0x1}}, 0x0)
socket$packet(0x11, 0x3, 0x300)
r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r4)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:37:44 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
write$FUSE_NOTIFY_INVAL_ENTRY(r0, &(0x7f0000000040)={0x29, 0x3, 0x0, {0x5, 0x8, 0x0, 'group_id'}}, 0x29)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:37:44 executing program 6:

03:37:44 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:37:44 executing program 1:

03:37:44 executing program 6:

03:37:44 executing program 1:
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='oom_score_adj\x00')
write$cgroup_int(r0, &(0x7f00000000c0)=0xffffffffffffffff, 0x7)

03:37:44 executing program 6:
perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x856, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = timerfd_create(0x0, 0x0)
timerfd_settime(r0, 0x0, &(0x7f00000000c0)={{0x0, 0x989680}, {0x0, 0x989680}}, &(0x7f0000000000))
read(r0, &(0x7f0000000100)=""/134, 0x86)

03:37:44 executing program 1:
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='oom_score_adj\x00')
write$cgroup_int(r0, &(0x7f00000000c0)=0xffffffffffffffff, 0x7)

03:37:44 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
getsockopt$IP6T_SO_GET_INFO(r1, 0x29, 0x40, &(0x7f0000000200)={'filter\x00'}, &(0x7f0000000040)=0x54)
accept4$packet(r1, &(0x7f0000000080)={0x11, 0x0, <r2=>0x0}, &(0x7f00000000c0)=0x14, 0x800)
r3 = getuid()
setsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000100)={{{@in=@multicast1, @in6, 0x4e20, 0x7, 0x4e24, 0xd, 0x2, 0x80, 0x20, 0x3f, r2, r3}, {0x93, 0x5, 0x40, 0x0, 0x8, 0x7, 0x7, 0x3}, {0xa9, 0x1, 0xfffffffffffffffc, 0x101}, 0x1ff, 0x6e6bbe, 0x3, 0x1, 0x1, 0x3}, {{@in, 0x4d4, 0xff}, 0x0, @in6=@local, 0x3505, 0x2, 0x3, 0x8, 0x956, 0x3, 0x8}}, 0xe8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:37:44 executing program 1:
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='oom_score_adj\x00')
write$cgroup_int(r0, &(0x7f00000000c0)=0xffffffffffffffff, 0x7)

03:37:44 executing program 6:
r0 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r0, 0x8912, &(0x7f0000000040)="0a5cc80700315f85715070")
rt_sigaction(0x400000000000007, &(0x7f0000000080)={0x4065cf, {0xffffdfbfffbff275}}, &(0x7f0000000000), 0x8, &(0x7f0000000100))
mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x4, 0x44031, 0xffffffffffffffff, 0x0)
syz_open_procfs(0x0, &(0x7f0000000140)="6f6f6d5f73626f72655fa50f2247c4269643c352409a29b2d94af041d0bc54c3901b356f33462dcf38dc")

[  496.215414] binder: 23030:23031 ioctl c0306201 20000440 returned -14
[  496.249062] binder: 23030:23044 ioctl c0306201 20000440 returned -14
03:37:44 executing program 6:
syz_open_dev$sg(&(0x7f0000d08ff7)='/dev/sg#\x00', 0x0, 0x81)
r0 = gettid()
timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000))
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000))
tkill(r0, 0x1004000000016)
r1 = socket$inet6(0xa, 0x1000000000002, 0x0)
ioctl(r1, 0x8912, &(0x7f00000000c0)="0a5cc80700315f85715070")

03:37:44 executing program 1:
r0 = syz_open_procfs(0x0, &(0x7f0000000100)='oom_score_adj\x00')
write$cgroup_int(r0, &(0x7f00000000c0)=0xffffffffffffffff, 0x7)

03:37:44 executing program 5:
perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x856, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2000000000002e, &(0x7f00000005c0)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @local}}}, 0x108)
setsockopt$inet6_group_source_req(r0, 0x29, 0x2f, &(0x7f0000000480)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @local}}}, 0xfffffffffffffe6a)

[  496.329443] binder: 23058:23066 ioctl c0306201 20000440 returned -14
03:37:44 executing program 7:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
acct(&(0x7f0000000180)='./file0/file0\x00')
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x200}}, 0x50)
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)

03:37:44 executing program 3:
r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0)
r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0)
ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16})
r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000280)='/dev/null\x00', 0x400000, 0x0)
ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f00000002c0)=<r4=>0x0)
write$P9_RGETLOCK(r3, &(0x7f0000000300)=ANY=[@ANYBLOB="1e00000037020002f6b400000100001d0100000000000000", @ANYRES32=r4, @ANYBLOB='\x00\x00'], 0x1e)
r5 = socket$nl_route(0x10, 0x3, 0x0)
ustat(0x3, &(0x7f0000000200))
r6 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0)
poll(&(0x7f0000000440)=[{r0, 0x8002}, {r5, 0x2000}, {r6, 0x2000}, {r0, 0x4000}, {r5, 0x7}, {r2}, {r3, 0x20}], 0x7, 0x3)
openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x800, 0x0)
openat$null(0xffffffffffffff9c, &(0x7f0000000400)='/dev/null\x00', 0x80, 0x0)
r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0)
sendmsg$nl_route(r5, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0)
dup3(r0, r2, 0x80000)
socket$packet(0x11, 0x3, 0x300)
r8 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00')
symlinkat(&(0x7f0000000340)='./file0\x00', r7, &(0x7f0000000380)='./file0\x00')
ioctl$LOOP_SET_FD(r0, 0x4c00, r8)
ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1)

03:37:44 executing program 1:
write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0xffffffffffffffff, 0x7)

03:37:44 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x802)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})

03:37:44 executing program 0:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0)
r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9)
setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3)
perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff)
getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58)
fchown(0xffffffffffffffff, 0x0, 0x0)
lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, <r2=>0x0})
close(r1)
mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}]}})
mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580))
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0)
pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00')
mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0)
mkdir(&(0x7f0000000080)='./file0\x00', 0x0)
rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00')
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}})
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0)
accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800)
stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0))
read$FUSE(r0, &(0x7f0000001000), 0x1000)

03:37:44 executing program 4:
mkdir(&(0x7f00000001c0)='./file0\x00', 0x0)
r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}})
r1 = open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0)
read$FUSE(r0, &(0x7f00000030c0), 0x1000)
read$FUSE(r0, &(0x7f0000001000), 0x1000)
write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50)
stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480))
write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90)
ioctl$FUSE_DEV_IOC_CLONE(r1, 0x8004e500, &(0x7f0000000040)=r0)

03:37:44 executing program 6:
inotify_init1(0x0)

03:37:44 executing program 1:
write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0xffffffffffffffff, 0x7)

03:37:44 executing program 6:
r0 = perf_event_open(&(0x7f0000aaa000)={0x2, 0x70, 0x856, 0x2}, 0x0, 0x0, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
getsockopt$EBT_SO_GET_INIT_INFO(0xffffffffffffffff, 0x0, 0x82, &(0x7f00000001c0)={'nat\x00'}, &(0x7f0000000240)=0x50)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000616ff8)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
sendmsg$unix(r3, &(0x7f0000bba000)={&(0x7f0000c57ff8)=@abs, 0x6e, &(0x7f00006c6ff0), 0x0, &(0x7f00009dffb8)=[@rights={0x10, 0x1, 0x1, [r1]}], 0x10}, 0x0)
recvmsg(r2, &(0x7f0000000000)={&(0x7f0000000100)=@generic, 0x80, &(0x7f000081afd0), 0x0, &(0x7f0000f9fff8)=""/90, 0x5a}, 0x0)
r4 = memfd_create(&(0x7f00000000c0)='/dev/sg#\x00', 0x3)
ioctl$TIOCMBIC(r4, 0x5417, &(0x7f0000000280)=0x1)
socket$inet6(0xa, 0x5, 0x0)
syz_open_dev$sg(&(0x7f0000000080)='/dev/sg#\x00', 0x0, 0x0)
inotify_init()
execveat(r4, &(0x7f00000002c0)='./file0\x00', &(0x7f00000003c0)=[&(0x7f0000000300)='nat\x00', &(0x7f0000000340)='proctrusted(GPL\x00', &(0x7f0000000380)='$\x00'], &(0x7f0000000500)=[&(0x7f0000000400)=']eth1+$eth1\x00', &(0x7f0000000440)='/dev/sg#\x00', &(0x7f0000000480)='/dev/sg#\x00', &(0x7f00000004c0)='\x00'], 0x1000)
fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000180))

03:37:44 executing program 1:
write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0xffffffffffffffff, 0x7)

03:37:44 executing program 1:
syz_open_procfs(0x0, &(0x7f0000000100)='oom_score_adj\x00')
write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0xffffffffffffffff, 0x7)

03:37:44 executing program 2:
r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0)
r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0)
read$FUSE(r1, &(0x7f0000000480), 0x1000)
write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa)
mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0)
sendfile(r1, r1, &(0x7f0000317000), 0xff8)
r2 = mmap$binder(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x8, 0x10, r1, 0x18)
ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000240)={<r3=>0x0})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x64, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0c000000000000040000000000000000000000110000000000000000000000500000000000000040000000000000001ddd4cb9d88fccb87dc96df0f0d7b1fe8e23f9496436e362888fac388f402dfa100041c4e5a918dba0a3a0f81362167c8dd002baa3c596b46a39a4de1017d5c98a5255949c766dc79c92dda1590003e59ca26cd0a919069c5f5ac9a87a88b7525b6d17c2f10aa667242a5e97858ca849da7a15c2f8abd0627ca2774daf5af27ec61b25d013e8c3ce14342674c6542ff86b12d70e7d8ff50add1efb1b8dd58709ee3421183773113f845ef3fb0c01047c", @ANYPTR=&(0x7f0000000100)=ANY=[@ANYBLOB="852a627700010000", @ANYRES64=r2, @ANYBLOB="03000000000000008561646600000000060000000000000000000000000000001100000000000000852a687301000000", @ANYRES64=r3, @ANYBLOB="4f6dbde2db1f57ff"], @ANYPTR=&(0x7f0000000080)=ANY=[@ANYBLOB="18000000000000000000000000000000380000000000000028000000000000003800000000000000780000000000000038000000000000003800000000000000"], @ANYBLOB="05000000000000000e630c400300000004000000000000000b630000"], 0x1000, 0x0, &(0x7f0000001480)="f4c24ed241675d489ce680356f413aabc3770accbfb7e7e2fa402215294440fc2623558a7f108b858ba703083cb08e7622c450a15f6fa147cfd4e4fcbfef895a6dc35e654d5f9af7cde83b33b85c2fc5a22707fff569a9deb6f0659b03433adef61af0000447386ece1a348a33098a715fdac2f7cfd40398ddc32a5ae25cf83a46bba2319409dee4c9ebc82dadbef569ce8ef98bbcddf4aab09098761405f5cab12bdc1cd3521718497ee86e3e536cc50b92b4ee62304a582c6695fd5f386876324ac38cf390dfdd167dc1c0e4804d9b89be582b00b6758cb5f4afd9746ba47d418af222f508d90a7d6f9ac20818d22a9f24f38c20c034f43b7b801b538dda05995622df75072dfde2cbb2c3455075e2114e3f5754eb69bd437076467438b5b43400c1d408e7a6991608b14538245bfc12ebd8f1d2506273d15f79fba3f383aad880601a31c1057813b9a2cb76b70355f67bd10cc4f1b4af84dcfe158a4101ab378369fd31b4a09e3b1cfd25d9c3be4b2500515847b3df7dfb7cc20f5d238c7ff7cfe0311d34dfb3b5de37e8e04c768239dcd4b871f66ca931e9b4c398e0b8f7ed49c78e95bce3cb51542db2720de55af516725602fb550841aa862a86c172b9012c852f55b5a4c65b840789186fe2c41a1f12cab701b1771aaca548859cb49dcef4fda5e8d672679bb7b2a75e9168c972a005519d2a2beded7b83a0813212df5112ba63d9f386ba7e939eba3217935cb7676901ba75300a3a668c1a85c1810eeafb9356bbcf1cf69ad6d5803bace4aa9851dc41950d6ac95e3e74fba1ff90092becdac1470acca704c8601b9bb6229bb99872fb7588221e1404f3eb849ca4f718454e13742139509505116d56c5ecc423414f28b418979adf5e32266a19bfe56f7b8ad068d2396a24ff84ffbfeb9aae44477040a0be7baf889adaf7d869a6e345974222170ced3a926d1d6c20c8a55a1ff448bdf73e9a9abbb7ef31f6adecdc75e617769d3b6924237535ba331032d294c3245503594d818985dfe9e511aa2980bd51a6d495e67b62e3d953077b06832bc780b982dd8122f8332ec6ac545b19f54fbdd8a3b543746bd5e9c2f4eef81d7106011d93244bb3211391fdf29b8ec6a67af45d9299534787fc26719ad25d0bcc4226930d305cd1ea4ab049ebe02a26358a74d1496f17e738f8007d1474292f2e1f78fa827bff082385e3b3a876bcbbf2db78e703a38505eac7c8383cf97fb646589ca2fedede7dc10b4b86a60c7921c5e41658105ab2ada390a36a4bc515d2d1476d5c20ca460aca9efb28f34396722fa462a101a6378e682a6550aedbbf9d5e17a40613ccbb72169082a7ad2274ddde88f17a7298ddd6b6b8ddc8f4b4f912dcc63e5f2a7cb865a1e68592ddbf9029a275f44189e30d0360c16ec0355b93e3065476c39d403f176417a67233bf72f3ccf356157566a9d27725e6a1d492ae513068a5c0d4f9be841ff200708367a7f949f73557d238eaa738289ca96cd55fa9e6b845ab5e43116df32d44ac0d4f6f2bffcae70f6a7f98f7899df10fdb53a99dc63adc11fb745c0563bc9982af26537b42e98252ed08367d9bc13f16cb3cd273225bdd325d34adc06b76e14dfabd0869b1daaf57721bd47954968b87338ab71272a125ab657b2310eb178b456adbce41beab09b467ed724ad32ab996de15de500aa1a0d72a23c44c925c15eaed52d3d7e2ad2a18284d1d507728fed96d9ae7971f2eb0a6920932bc34e9df47e2b49a688d6796a63164e6dd6426e6447e786ed47113b595000592959d3bb84629dc3ed97b48768ecf8b7bd2848284c73ad91992e715b14e531000648a6656dc4ec06e233748de42fb3d1ee2fa54ac3381b63a3cbd6d4c39b120ba742c171182ba16fee067375f194145be7450cd804c2713d39bf37f836aedeba2902bb7639e63376d9fec84137fc73ee9c8db4d7e8e70a743c4824406167639bb58912cbf31b15a0279ed17b86fccb07c35bc91e87c1f58c9d4abd86dbc88ceecbfc304e077685db0ec9ce7726f1a7d635c09ec94a0ba930bfd6137a68b3066f595cfb7de620d9ad0d02b8289a47ab028af135a9551e46c0819307f4f29f606cade5cc3afa4e5e6bbac7c3586c10144b7d54dd8542a0cf7866baffac4b770786eb17c5f4ed98715eb9e78d4b4b73b3793fbbf038c6621e87a9df11f4e895a8bfd9163072a32e9aeb6f71ad98f23e631e6b71d672f4b9147d24be976a709bfb3a3bfc87fe78af311e0ddb2b2afd51cbe231a359ad747dd4efa0434ddfbfc5a815c238cf73fb40b9a06a08f4995f9d096be19b61158383011899e079244e77985c308badbbd02f618a18dbbb89bd84e61e0f4802ed62b061103e93233c217b3de1e7062013ef5cc8f83c99f93e7d73c21c5755cb513bbca12fa772678f96ee47783c618a36f43c60d0f4ee6e489939366e491570eceaa9fdf0df32b09b5e6d828709426f5a88f0fecd6b9f3dfd7c144cb801e75e74be22f9df92e4ea2e1ec3c2455a3ecd81dbe06db394517b8af2ba5e2c242dc35f62dee6665f54019abdfda00832657d5ee7ab9f4c05d4a1c3876d777dc74ba61e097cdd046d625cb80222d18ee1ba1fcae11002baf60b2801cd96da69008e5afc4660262e652f06747afdaae54c156eee101241c28754dab6bcb87d553e1a511be7a8d242ceeb54097e909d1fb487f0deda7f89e35c0e6e6d53f259767bd5d660f3fb830555efb08f14cf908d50d0b92b0914205f16a21914d035c72536f3de34d6609a02b764922fdd5c3deb1f02dc05376f337b1e7fb3af8c0adcd3f5e149731dfeb0ad29192ecfa00cd4fbf75be17408004a259fb0be4788297555d2c260e72c7e7d9c18291619b5f8f318a4423555eb340df899515c111fc699f815e908178d85211d89a7cbd44df919a7892f9ba9803c8bf369078c9bd268f03b09781ec27d2e7c20ef0dc9a462e7da15638386906c67e887dc20cac8c8167e5ed3bf3f527ba0887975f5b77378d52dc570d6734884c7bed005e26a41f83e66eaa13c5e25503ea9eba19949b35c5568567b6e8cf43a829441c46c845647d1af08918afaf587eeecbea1e378ef094f3c957303d44f10350990d0710aadd0e0b1c230aa8e3da8edf3c0a26471c8ea784b995df667d9858001040bac0de1cce6b81f8680285f883887cd5b9793f22724670d6fa3ad29927f88c978e492ec54961ad443fa395424791088b8b2fcdfb2b61b5c5c02d64033f576ba260167939d88155a7e7f9361129c53b56af0e0f30f674ec669901ffc53fe5625fbf7e0651d846762cd0a1c76537e3d6b362992eb0964e0098d68c297c37bfbd7b02cfb45b8afafdc0cb20834c356377b7cc64ed98c9a6bc88da1311b42d9542ccae180aa2dc70141e33425e6277b2e0e34078d284fa846a9401e9b35c0ef8aafb0435cd120c3d33fa2218c96710786f1b421248679295080b2a155dc059aa9e2b9d9e54685d3a84d13ddf01aaf36536ebfd6f5859b8bd5fde79f989e5feaa08b157d1b3e7167dd89a3bf125f7267d2dfff6fa57c7269f66c97775ef2cf022bd3dbca04e7f480aae2e3361491152584dea92963b7bbe5236bb50d25326854c8372ac1d7cd1579db42402a47acb0ddf82e2eb83144efcb63346d4a74cad0461762251ea06d0ddc4b34b7b3033dfb049b8f3f2ab79071e2805ebebe7e1476ada3cd1be4712b147ebab2cbee4fff1631080400d646b14ebbc8441e3207f368d14ed0dcd8d76ea0268271b185b8ce9073f6edd496b5cea3477e9a718eedb622a36e9715c0a35f813fd340116ee108643d0079bd79e7cfb90ae936c328c1e90e599f63127ef9ec9cf778343ff1f3c18c9e041fe8614d6e1ba3992913972684e26e1659511a28edc40266773a35c4e8dcf9c642146f307793e9be58e830b34cd206b9974c73b5fd5e117297f7926ce6d1bbb0cdc744b90e3721161de6c78524c62eb6654fb3d744986db75416333ace106c157aabac9ab23551133948b803cd3cc1d1f3ca2c99fe2ba7dae9b485a9fcf358137309b910c78164e9aae854dca5bd73ce0473d2071c268cc6c458e802a29d97265c8008c423e12fdb06c5a23e83e49cfb2e156879d439541636b3b1a32a9fcc86b9d1bdcbd6c5eefcfc11d1820cbcf699e2d5b50bd3530aaa4b948df54134500ea4c0b8bbacc4714960b8e3f6a4745014c096a8bfa06f58d6e5e8db6d853f45d51c295158768708bff5d5710d46aae0bacef1691b6b352cf58c6d497d5df0006c4a60de3278861abbb695c56b85d857a976957130613b6729507a64d7245469086dc8610a3f16bea225394d7e72718b9e7a97ac8b4ee1ef7e29fbe6e2345b298d764c354972c07e6b9ef3aed19aa8c0e73ae7b6db0c1a12dab6f85b1776250f91c1637fa91c68221472611388690f2f3bef3d0ea105582c47dce0fcf5f1cb3242773dd799b30149f87bc17e2a7af765de512e57d5d9adcc722b210d5eef51ecbb29e656ad69afac887371287c7370a73eabd8721ac9b30123a4af150f7d115875d91d9d557db5d36958fa02a27beed82d2a9931e3c02b7f24054ef8e31ce57c6415a6dd69fe5c37acf527f0dec6568e16a1e4f0bff8ad097a718b9e4f9dba91ce8f65b737bea2b3b7770b5aff9ff16ea7821b043dc3a8696add1576cdcfc2d8c156f08d30f96c149dec893c4de58df3cc1adcb25da7268ee2d2173d1efb00859b86dbd51aa6e28b0891b1126bc4926172ee9075230d8526e595c4b897ae947f130baa282e7ef5c87bc2f7aba7e98cdea6ee35296cf73ddaba0c04ddfa6a24cffcf333f61cd8366e4a3e946621cc2081a7923b051c3220c8ae0eaf0c4c4ae71cd079fdb90a1b2ab0f5cae324ca8bb123d085568054c9017a963d092b257fdb841a3864e949ac3eacac0c098bcabcf0ef5cf9bb14b97bfa7c97c2410ca530130534bd335d65c4fff675f9b78d7cc7a9d0aa797e20b19342626e60a6cb1b6e82ed37e85fb0d785d79a058c431daafc944484a444618a8ac95cff5bf5009c33f00013684ac6a0f234f1ca13c11c1b421fd7a9680fb02da052330a86c7e6c18d2b530fe57c2538d4afe684c8532473c9ebbb549cffe7404fc3e80775db2e605bc50ebbd3ccc2eda91830ed7b5b304e60063de5a88cea8969d61f28f637cec00c52853c6f5f4f5873a5d00ff35983407be5c33a84afcf34feb7b4883615769a7ce5ae07e3d77487eca08c5791bd8096e50bde47c830d8c5242e0577ee15faaaef8b52e54404ff9cbcfb25fd0740819424af0763574715fe91d876799d08ff8d95ff43569ac144d7bab5e2f859306b87ac95e1566315092703816221a6f7067ccea4650a90c01b8a514fdae5ef89234e8c05c189106a7a8a9a870b4ea4a1528abc451a1d923199df405e22b5f95ea78c7b1c2d3aac9a2e86cc6168f7191ca428f0ce83ed504569be79d80f38228796bd280b41f4f4e63c2dd5ee1a68106692c22e5baa4aba5427a5f2f38b5f12c0dace61ca7c80c6d7fa969612731df2e228f00138d794e625bde3e58e740ba23275a45df01ea01921bce68f0298b22720787e40f1714a1669ba662779c0463958713b2cee589c9868fa720d0396122c5a452f2b542ee9f1e06f47bafca9d86f99cdd437ce32312a6d71f6ca87b531f1d54aebb8f49c0aa74d53ee34f012b51df32acbae1796d591afed86f88363f1a7558cb67eb9765b542c2f1451c4872d04dbc1922df284fa511124e49bcbd607ef0abea31a102ff9fdf9a416b937330758306c1f8b9ba203c8b6f"})
ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)})
ioctl$ASHMEM_SET_PROT_MASK(r1, 0x40087705, &(0x7f00000000c0)={0x0, 0xb256})
ioctl$FICLONE(r1, 0x40049409, r0)
syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x5, 0x40000)

03:37:44 executing program 1:
syz_open_procfs(0x0, &(0x7f0000000100)='oom_score_adj\x00')
write$cgroup_int(0xffffffffffffffff, &(0x7f00000000c0)=0xffffffffffffffff, 0x7)

[  496.534773] binder: 23095:23099 ioctl c0306201 20000440 returned -14
[  496.621461] binder: 23128:23129 ioctl c018620b 20000240 returned -14
[  496.675746] binder: 23128:23140 ioctl c0306201 20000440 returned -14
[  497.386571] binder: 23128:23140 ioctl c018620b 20000240 returned -14
[  497.387080] binder: 23128:23146 ioctl c0306201 20000200 returned -14
[  497.387339] binder: 23128:23146 ioctl c0306201 20000440 returned -14
[  497.387615] binder: 23128:23129 ioctl c0306201 20000200 returned -14