ge_slave_0: link becomes ready [ 362.684595] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 362.705577] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 362.716731] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 362.724219] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 363.089707] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 363.187416] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 363.193542] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 363.200885] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 363.382272] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 363.487955] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 363.494113] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 363.501358] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 364.011025] device lo entered promiscuous mode [ 364.019178] device lo left promiscuous mode [ 364.363552] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 364.419306] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 364.426213] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 364.436592] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 364.542239] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 364.597565] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 364.603678] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 364.611273] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 364.861934] binder_alloc: 4678: binder_alloc_buf failed to map page at 20001000 in userspace [ 364.870882] binder: 4678:4680 transaction failed 29201/-12, size 0-0 line 3136 [ 364.881952] binder: BINDER_SET_CONTEXT_MGR already set [ 364.888104] binder_alloc: 4678: binder_alloc_buf, no vma [ 364.893650] binder: 4678:4680 ioctl 40046207 0 returned -16 [ 364.899759] binder: 4678:4684 transaction failed 29189/-3, size 0-0 line 3136 [ 364.907702] binder: undelivered TRANSACTION_ERROR: 29201 03:35:32 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000028c0)={{{@in6=@loopback, @in=@remote}}, {{@in6=@mcast1}, 0x0, @in=@multicast2}}, &(0x7f0000000400)=0xe8) getgid() 03:35:32 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) getsockopt$inet6_buf(r0, 0x29, 0x32, &(0x7f0000000540)=""/4096, &(0x7f0000000000)=0x1000) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:35:32 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) setsockopt$inet_mreq(r0, 0x0, 0x23, &(0x7f0000000000)={@multicast2, @multicast2}, 0x8) [ 364.935396] binder: undelivered TRANSACTION_ERROR: 29189 [ 364.961449] device lo entered promiscuous mode [ 364.969368] binder_alloc: 4703: binder_alloc_buf failed to map page at 20001000 in userspace [ 364.978049] device lo left promiscuous mode [ 364.983248] device lo left promiscuous mode [ 364.986122] device lo entered promiscuous mode [ 364.987875] device lo entered promiscuous mode [ 364.992516] device lo left promiscuous mode [ 364.997508] device lo left promiscuous mode [ 365.016829] binder: 4703:4706 transaction failed 29201/-12, size 0-0 line 3136 03:35:32 executing program 4: r0 = perf_event_open(&(0x7f000025c000)={0x2, 0x70, 0x3e3}, 0x0, 0x0, 0xffffffffffffffff, 0x0) perf_event_open(&(0x7f0000001f88)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000fff)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000bf0000/0x2000)=nil, 0x2000, 0x0, 0x10, 0xffffffffffffffff, 0x0) exit(0x0) r1 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)) 03:35:32 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(0xffffffffffffffff, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) 03:35:32 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) ioctl$TUNSETSNDBUF(r2, 0x400454d4, &(0x7f0000000200)=0xbb21) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="030000000000000008001b0000000000ee61d17102d7ac14f729a2200969b34860fad8dd9d92438438781ec49736c8277a6d753d086d18a9fb8308dd20d566f2bd8b1b866291c5116de22754c74fa405f55aeb66d914b50feffcea43f76233082fe2aa301d7261defade4f06958d01a87e6f8a085d5498e36d3fad990d55d5eb6bd475b995cfb25f137224aaf8a4e8a7eebd2a29739b0321520f710f02a0f004a65e8980f17cb01741bd603d8e449fe334ba589587bc8ff330c0717110a751f68214a12acb28d4c35771fb2b2551e6ef321b9488f89ceba69a46756085c4879ef7c9"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:35:32 executing program 6: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f0000000140)=0x78, 0x4) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @multicast1}, 0x10) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockname$inet(r0, &(0x7f0000000100)={0x2, 0x0, @rand_addr}, &(0x7f0000000180)=0x10) ioctl$int_in(r0, 0x5452, &(0x7f0000000380)=0x3) sendto$inet(r0, &(0x7f0000a88f88), 0x29f, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @loopback}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xff6c, 0x0, &(0x7f00000000c0)={0x2, 0x0, @dev}, 0x10) socket$inet6_udp(0xa, 0x2, 0x0) 03:35:32 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:35:32 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) fchmod(r0, 0x100) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'lo\x00@\x00', 0x4000}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) setsockopt$inet_tcp_TLS_TX(r0, 0x6, 0x1, &(0x7f0000000040), 0x4) 03:35:32 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x80ffc) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:35:32 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000028c0)={{{@in6=@loopback, @in=@remote}}, {{@in6=@mcast1}, 0x0, @in=@multicast2}}, &(0x7f0000000400)=0xe8) getgid() [ 365.075810] binder: undelivered TRANSACTION_ERROR: 29201 03:35:32 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$packet_buf(r0, 0x107, 0x5, &(0x7f0000000000)="b40c984422a65d06963653c8eb544be51e6b0f64275554825d61c4", 0x1b) r1 = creat(&(0x7f0000000040)='./file0\x00', 0x30) ioctl$EVIOCGLED(r1, 0x80404519, &(0x7f00000000c0)=""/37) getsockname(r0, &(0x7f0000000100)=@pppoe={0x18, 0x0, {0x0, @random}}, &(0x7f00000001c0)=0x80) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'lo\x00@\x00', 0x1200}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:35:33 executing program 1: r0 = dup3(0xffffffffffffff9c, 0xffffffffffffff9c, 0x80000) ioctl$sock_inet_SIOCRTMSG(r0, 0x890d, &(0x7f00000001c0)={0xfffffffffffffff7, {0x2, 0x4e23, @multicast2}, {0x2, 0x4e24, @broadcast}, {0x2, 0x4e24, @rand_addr=0xd5aa}, 0x4, 0xfffffffffffffffb, 0x4, 0x5, 0x100000000, &(0x7f0000000140)='bridge_slave_1\x00', 0xffffffff7fffffff, 0x27d, 0x1}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) ioctl$sock_SIOCDELDLCI(r1, 0x8981, &(0x7f0000000000)={'bcsh0\x00', 0x10000}) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x2, 0x0) getsockname$inet6(r2, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={[], [], @dev}}, &(0x7f0000000100)=0x1c) [ 365.146672] device lo entered promiscuous mode [ 365.153059] binder_alloc: 4729: binder_alloc_buf failed to map page at 20001000 in userspace [ 365.166521] device lo left promiscuous mode [ 365.172487] binder: 4729:4733 transaction failed 29201/-12, size 0-0 line 3136 [ 365.184718] device lo entered promiscuous mode [ 365.200617] device lo left promiscuous mode [ 365.220649] device lo entered promiscuous mode [ 365.235053] device lo left promiscuous mode 03:35:33 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:35:33 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000028c0)={{{@in6=@loopback, @in=@remote}}, {{@in6=@mcast1}, 0x0, @in=@multicast2}}, &(0x7f0000000400)=0xe8) getgid() 03:35:33 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) r1 = open(&(0x7f0000000000)='./file0\x00', 0x83058d55bf30f73, 0x60) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(r1, 0xc0605345, &(0x7f0000000040)={0x580, 0x1, {0x0, 0x0, 0x0, 0x2, 0xefe}}) [ 365.256097] binder: undelivered TRANSACTION_ERROR: 29201 [ 365.312071] binder_alloc: 4761: binder_alloc_buf failed to map page at 20001000 in userspace [ 365.326749] binder: 4761:4763 transaction failed 29201/-12, size 0-0 line 3136 [ 365.349879] device lo entered promiscuous mode [ 365.356425] device lo left promiscuous mode 03:35:33 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x5, 0x10000) ioctl$KDDISABIO(r1, 0x4b37) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:35:33 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000028c0)={{{@in6=@loopback, @in=@remote}}, {{@in6=@mcast1}, 0x0, @in=@multicast2}}, &(0x7f0000000400)=0xe8) [ 365.364564] device lo entered promiscuous mode [ 365.365520] binder: undelivered TRANSACTION_ERROR: 29201 [ 365.386079] device lo left promiscuous mode [ 365.400352] device lo entered promiscuous mode [ 365.404302] binder_alloc: 4774: binder_alloc_buf failed to map page at 20001000 in userspace 03:35:33 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 365.404974] binder: 4774:4776 transaction failed 29201/-12, size 0-0 line 3136 [ 365.425995] device lo entered promiscuous mode [ 365.426675] binder: undelivered TRANSACTION_ERROR: 29201 [ 365.444501] device lo left promiscuous mode [ 365.451532] device lo left promiscuous mode [ 365.457775] device lo entered promiscuous mode [ 365.464408] device lo left promiscuous mode [ 365.486611] binder_alloc: 4778: binder_alloc_buf failed to map page at 20001000 in userspace [ 365.502340] binder: 4778:4779 transaction failed 29201/-12, size 0-0 line 3136 [ 365.535450] binder: undelivered TRANSACTION_ERROR: 29201 03:35:33 executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f000099e000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r1, &(0x7f0000000200), 0xfffffffffffffeb4, 0x20008005, &(0x7f0000db4ff0)={0x2, 0x4e20, @loopback}, 0x10) syz_open_procfs(0x0, &(0x7f0000000300)='schedstat\x00') recvfrom(r1, &(0x7f0000f9cf9b)=""/101, 0x6478c8501c739c9d, 0x120, 0x0, 0x35) sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000340)={&(0x7f00000003c0)=ANY=[@ANYRES16], 0x1}}, 0x0) 03:35:33 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0x4000}) syz_mount_image$ext4(&(0x7f0000000080)='ext3\x00', &(0x7f0000000100)='./file0\x00', 0xfffffffffffffff7, 0x6, &(0x7f00000004c0)=[{&(0x7f00000001c0)="eec3ce9c28a9797165c481ad693d22cfcfc2cc45cfe52d9bdcf4fb66386de7752d97d4c4c6fea1a406eb756da2d784affd244ac4c1ecbacbbf0543bf703e7fb57806ce0db8fe8af5f9fb41057dbc55442aa235da1e78ca6a2ab28b34abd116a92c5719c6739a878051824749e326ec4889d7af16375c", 0x76}, {&(0x7f0000000240)="61bc19419f3217f2d8529bc952a38ec0a303f8d982761360701f8cf8238003c1747c15cabf59cf482032d76c9a1dc9e50b6a81f26337b5fa82ad996e48f3113a4efbb967b3a94f69a6fd62196aa76b63b8b172ce7a6c98ad4adc719f25f59403154649eb36aa8be3a6ce51ec9aeb2e32f85824c83f9e0bfadce458c95118b6aa0eb04476642968d48847fafee975a771fbf599171343471d07a31895b86f9d4f63", 0xa1, 0x4}, {&(0x7f0000000140)="1fa7551b2b6f3953acb00b0fa76afa824170011547a70b3d74e65514e2faa42f3402b1b5ca1f519ce19cfc", 0x2b, 0x1000}, {&(0x7f0000000300)="81e87814af4e9dc1dffba231386c2ee6641fb510d1f643", 0x17, 0x7}, {&(0x7f0000000340)="7b8a7371275b8c216357aad5ece57d12cb0548988a3e8b7a51ca1c9eb0ef386ae66571aca1900e428367c5547f4ec4584f20a57d5b311aa02a7bb3761c6c4bc0f3c9b2cecd73b5cc74f966efbe0377162223d62f4ded5b648ee4a8f5fcf454647050ca2415f553a5fcf1845f6693d36a9126c939e154aabedd2bd43037094471a1defc2b18162041eb45da0b5f5409a030bc196d9d8dde46410981f698c07fcf9eba50b21e702cda5ecccc550b4dfde999db0670b4", 0xb5, 0x100}, {&(0x7f0000000400)="5960af129b57f961629aef7b4669478ade433d5a90a51a0961f8c6dadfdfcc1b7f4eac68829a67741dc29d6bac637397bfa4d842dc9189e6adfac2198bbf91aebe6e7608515c824014b07609632a852603d3737b7a2c187712d1f9c33bdc59d3103041d4b7c0145890824aeb9049d217b6bd4523e5ef67a59dd213c040bc097f22849f76c7eb0fa80dbc4f4bfb915da3748512338d50332050bbffb09be6af7895b38d4e7e783094fb8ffdc54bfde9952e0c473cc3ec9376b9831449", 0xbc, 0x40d}], 0x10020, &(0x7f0000000580)={[{@dax='dax'}, {@init_itable_val={'init_itable', 0x3d, 0x6}}, {@nodiscard='nodiscard'}, {@debug='debug'}]}) ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f0000000040)=@req={0x28, &(0x7f0000000000)={'veth0_to_bridge\x00', @ifru_names='veth0_to_bond\x00'}}) 03:35:33 executing program 5: seccomp(0x0, 0x1, &(0x7f0000000040)={0x2, &(0x7f0000000080)=[{0x6, 0xc8, 0x5, 0x7f}, {0x94b0, 0x6, 0xffffffff}]}) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={'bond0\x00'}) 03:35:33 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={'v\x00', 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = syz_open_dev$sg(&(0x7f0000000280)='/dev/sg#\x00', 0x200, 0x0) ioctl$SG_GET_RESERVED_SIZE(r4, 0x2272, &(0x7f00000002c0)) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = syz_open_procfs(0x0, &(0x7f0000000200)='mountinfo\x00') ioctl$SG_GET_RESERVED_SIZE(r4, 0x2272, &(0x7f0000000300)) ioctl$LOOP_SET_FD(r0, 0x4c00, r5) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:35:33 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:35:33 executing program 6: r0 = socket(0x40000000002, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='ip6tnl0\x00', 0x10) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000180)=0x830, 0x4) sendto$unix(r0, &(0x7f0000000080), 0x7272, 0x0, &(0x7f0000000d00)=@abs={0x0, 0x0, 0x10000e0}, 0x6e) readv(0xffffffffffffffff, &(0x7f0000000500), 0x0) 03:35:33 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(0xffffffffffffffff, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) 03:35:33 executing program 6: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f0000002000)) r2 = socket$inet6(0xa, 0x2, 0x0) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}}) setsockopt$inet_mreqsrc(r2, 0x0, 0x2000000000000004, &(0x7f0000013ff4)={@remote, @rand_addr}, 0x6) setsockopt$inet6_MCAST_MSFILTER(r2, 0x29, 0x30, &(0x7f0000000040)=ANY=[], 0x0) close(r2) dup3(r1, 0xffffffffffffffff, 0x0) [ 365.972907] device lo entered promiscuous mode [ 365.990495] binder: 4795:4799 transaction failed 29189/-22, size 0-0 line 3013 [ 366.000300] device lo entered promiscuous mode 03:35:33 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000040), &(0x7f0000000080)=0x8) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'lo\x00@\x00', 0x101}) r1 = accept4$packet(0xffffffffffffff9c, &(0x7f00000000c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14, 0x80000) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000140)=@req={0x5, 0x8, 0x5, 0x20}, 0x10) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0x400000}) [ 366.015242] device lo left promiscuous mode [ 366.059822] device lo entered promiscuous mode 03:35:33 executing program 6: r0 = socket$inet6(0xa, 0x80002, 0x88) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @local}, 0x1c) sendto$inet6(r0, &(0x7f0000000300), 0x0, 0x400806e, &(0x7f00000000c0)={0xa, 0x4e23, 0x0, @mcast1}, 0x1c) sendto$inet6(r0, &(0x7f0000000240)="d6", 0x1, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @remote}, 0x1c) [ 366.076537] device lo left promiscuous mode [ 366.125878] device lo entered promiscuous mode [ 366.145791] device lo left promiscuous mode [ 366.165726] binder: undelivered TRANSACTION_ERROR: 29189 [ 366.184058] device lo entered promiscuous mode [ 368.389395] IPVS: Creating netns size=2536 id=82 [ 368.560361] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 368.573690] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 368.630444] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 368.644130] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 368.699857] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 368.713368] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 368.727909] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 368.742699] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 369.390747] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 369.426186] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 369.432294] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 369.439591] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:35:38 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:35:38 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = dup3(r0, r0, 0x80000) setsockopt$inet_tcp_TCP_FASTOPEN_KEY(r1, 0x6, 0x21, &(0x7f0000000000)="a1959ce24c1ee1996c1b1faa97da9ec9", 0x10) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:35:38 executing program 6: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000001400)={&(0x7f00000001c0), 0xc, &(0x7f00000013c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="14000000120005010000000000000000c5000000"], 0x1}}, 0x0) 03:35:38 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:35:38 executing program 4: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_user\x00', 0x0, 0x0) mkdirat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sg(&(0x7f00000002c0)='/dev/sg#\x00', 0x0, 0x0) syz_open_dev$sg(&(0x7f0000d08ff7)='/dev/sg#\x00', 0x0, 0x81) r1 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12}, &(0x7f0000044000)) timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, &(0x7f0000000000)) tkill(r1, 0x0) close(r0) setsockopt$IP_VS_SO_SET_STARTDAEMON(0xffffffffffffffff, 0x0, 0x13, &(0x7f0000000200)={0x0, 'bridge_slave_1\x00'}, 0x14) 03:35:38 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x104}) socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:35:38 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x402200, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000280)={0x0}, &(0x7f00000002c0)=0xc) write$P9_RGETLOCK(r4, &(0x7f0000000300)={0x1f, 0x37, 0x1, {0x2, 0x74, 0x1, r5, 0x1, '@'}}, 0x1f) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r6 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r6) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:35:38 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(0xffffffffffffffff, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) 03:35:38 executing program 6: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_FIOGETOWN(0xffffffffffffffff, 0x8903, &(0x7f00000064c0)) add_key(&(0x7f0000000280)='asymmetric\x00', &(0x7f0000000300), &(0x7f0000000340)="fa", 0x1, 0xffffffffffffffff) mkdir(&(0x7f0000000180)='./file1\x00', 0x0) syz_mount_image$ext4(&(0x7f0000000100)='ext-\x00', &(0x7f0000000140)='./file1\x00', 0x8cffffff00000000, 0x0, &(0x7f0000001800), 0x820, &(0x7f0000000240)) 03:35:38 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 370.484150] device lo left promiscuous mode [ 370.490759] binder: 5219:5229 transaction failed 29189/-22, size 0-0 line 3013 [ 370.509780] device lo left promiscuous mode [ 370.515461] device lo entered promiscuous mode 03:35:38 executing program 6: r0 = syz_open_procfs(0x0, &(0x7f0000000080)='oom_score_adj\x00') mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1, 0x18032, 0xffffffffffffffff, 0x0) write$binfmt_misc(r0, &(0x7f0000000000)={'syz1'}, 0x4) [ 370.525631] binder: undelivered TRANSACTION_ERROR: 29189 [ 370.563354] binder: 5242:5247 transaction failed 29189/-22, size 0-0 line 3013 [ 370.575374] device lo entered promiscuous mode [ 370.584546] device lo left promiscuous mode 03:35:38 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:35:38 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0x400}) setsockopt$sock_int(r0, 0x1, 0x3, &(0x7f0000000040)=0xfff, 0x4) syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x6f, 0x100) 03:35:38 executing program 4: fremovexattr(0xffffffffffffffff, &(0x7f0000000100)=@known='security.ima\x00') r0 = gettid() timer_create(0x0, &(0x7f0000044000)={0x0, 0x12, 0x0, @thr={&(0x7f00000002c0), &(0x7f00000003c0)}}, &(0x7f0000000280)) timer_settime(0x0, 0x0, &(0x7f00000001c0)={{0x0, 0x1c9c380}, {0x0, 0x9}}, &(0x7f0000000200)) tkill(r0, 0x0) [ 370.602998] binder: undelivered TRANSACTION_ERROR: 29189 03:35:38 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00@', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:35:38 executing program 6: r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.cpu\x00', 0x200002, 0x0) fchdir(r0) mknod$loop(&(0x7f0000000440)='./file0\x00', 0x0, 0xffffffffffffffff) unlink(&(0x7f00000004c0)='./file0\x00') [ 370.641781] device lo left promiscuous mode [ 370.684303] device lo entered promiscuous mode [ 370.696114] binder: release 5260:5267 transaction 27 out, still active [ 370.696119] binder: undelivered TRANSACTION_COMPLETE [ 370.701380] binder: send failed reply for transaction 27, target dead 03:35:38 executing program 4: perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000004c80)={{{@in6=@mcast1, @in6=@ipv4={[], [], @remote}}}, {{}, 0x0, @in=@multicast1}}, &(0x7f0000004d80)=0xe8) add_key(&(0x7f0000000280)='asymmetric\x00', &(0x7f0000000300), &(0x7f0000000340)="fa", 0x1, 0xffffffffffffffff) 03:35:38 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:35:38 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:35:38 executing program 6: r0 = socket$inet6(0xa, 0x3, 0x3a) setsockopt$inet6_int(r0, 0x29, 0x2000000c8, &(0x7f0000000000), 0x4) syz_emit_ethernet(0x66, &(0x7f00000000c0)={@random="2fd6b1be27a3", @remote, [], {@ipv6={0x86dd, {0x0, 0x6, "06f526", 0x30, 0x3a, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}, @mcast2={0xff, 0xffffff89}, {[], @icmpv6=@pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "0a07ec", 0x0, 0x0, 0x0, @remote={0xfe, 0x80, [], 0xffffffffffffffff}, @ipv4={[0xf5ffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [], @dev}}}}}}}}, &(0x7f0000000040)) 03:35:38 executing program 1: r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000240)='/dev/ppp\x00', 0x1, 0x0) fremovexattr(r0, &(0x7f0000000280)=@random={'system.', 'syzkaller1\x00'}) r1 = dup2(0xffffffffffffffff, 0xffffffffffffff9c) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000040)='fou\x00') ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000200)={'syzkaller1\x00', 0x800}) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x18, r2, 0x0, 0x70bd29, 0x25dfdbfd, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x5}, 0x5) r3 = socket$inet_tcp(0x2, 0x1, 0x0) openat$cgroup_subtree(r1, &(0x7f00000001c0)='cgroup.subtree_control\x00', 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:35:38 executing program 3: r0 = syz_open_dev$usbmon(&(0x7f0000000200)='/dev/usbmon#\x00', 0x4, 0x8080) ioctl$TUNDETACHFILTER(r0, 0x401054d6, 0x0) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000580)='/dev/loop#\x00', 0x20000000000, 0x40080) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$BINDER_THREAD_EXIT(r0, 0x40046208, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r4 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) ioctl$EVIOCGKEYCODE(r6, 0x80084504, &(0x7f0000000280)=""/162) getsockopt$inet_IP_XFRM_POLICY(r5, 0x0, 0x11, &(0x7f0000000400)={{{@in=@multicast2, @in6=@loopback}}, {{@in=@broadcast}, 0x0, @in6=@remote}}, &(0x7f0000000340)=0xe8) r7 = socket$packet(0x11, 0x3, 0x300) r8 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') fcntl$addseals(r7, 0x409, 0x3) ioctl$LOOP_SET_FD(r1, 0x4c00, r8) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2) [ 370.741939] device lo entered promiscuous mode [ 370.756959] device lo left promiscuous mode [ 370.763412] device lo left promiscuous mode 03:35:38 executing program 6: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0x400}) setsockopt$sock_int(r0, 0x1, 0x3, &(0x7f0000000040)=0xfff, 0x4) syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x6f, 0x100) [ 370.806580] binder: release 5286:5291 transaction 29 out, still active [ 370.813279] binder: undelivered TRANSACTION_COMPLETE [ 370.840925] device lo entered promiscuous mode [ 370.869936] binder: send failed reply for transaction 29, target dead [ 370.912806] device lo entered promiscuous mode [ 370.918924] device lo left promiscuous mode [ 370.924134] device lo entered promiscuous mode [ 370.933481] device lo left promiscuous mode [ 370.942381] device lo left promiscuous mode [ 370.986803] device lo entered promiscuous mode 03:35:39 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[], 0x0) 03:35:39 executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:35:39 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000280)={{{@in6=@local, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in6=@remote}}, &(0x7f0000000380)=0xe8) setsockopt$inet6_IPV6_PKTINFO(r2, 0x29, 0x32, &(0x7f0000000400)={@local, r3}, 0x14) r4 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r5 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r5, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$TIOCGPGRP(r6, 0x540f, &(0x7f0000000440)) getpgrp(0xffffffffffffffff) ioctl$sock_FIOGETOWN(r2, 0x8903, &(0x7f0000000480)) r7 = gettid() r8 = syz_open_procfs(r7, &(0x7f0000000580)="09002a22b4097866002a2399994efae04bf87f000000000000007791bef3bedc5f1c06004780c0e435210400000009000000000000002a27abd3eae72c1d5aac0000000000000000000000000000000000000000000000") ioctl$LOOP_SET_FD(r0, 0x4c00, r8) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:35:39 executing program 5: perf_event_open(&(0x7f00000004c0)={0x5, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x9a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xcd, 0x6}, 0x40000000000000, 0x0, 0x0, 0xfffffffffffffffd, 0xffffffffffffffff}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = socket$inet6(0xa, 0x400000000001, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f0000000280)={@in6={{0xa, 0x0, 0x0, @mcast1}}, 0x0, 0x1f, 0x0, "8c0eb7912a86ff3e23764a3c01af55410c3d3f813a4513a691be997c7ee1235982875b8ae5c27fc73eb383beca956b51a34191ad3a9f70ebee5f1d003dcd4427c273be993dd363cc8f36cc7f609a2371"}, 0xd8) r2 = dup(r1) setsockopt$inet6_tcp_int(r2, 0x6, 0x20000000000002, &(0x7f00007b1000)=0x81, 0x4) bind$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e20}, 0x1c) sendto$inet6(r1, &(0x7f0000e77fff), 0x2bd, 0x20000008, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f0000000100)="12", 0x1, 0x80, &(0x7f0000000140)={0xa, 0x0, 0x0, @loopback}, 0x1c) ioctl$BLKSECDISCARD(r0, 0x127d, &(0x7f0000000000)=0x4) r3 = open(&(0x7f00000001c0)='./bus\x00', 0x141042, 0x0) ftruncate(r3, 0x7fff) sendfile(r1, r3, &(0x7f0000000040), 0x8000ffffffee) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x4000000000101}) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:35:39 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) mmap$binder(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x8, 0x4031, r1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0x1}) 03:35:39 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:35:39 executing program 4: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:35:39 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 371.299557] device lo left promiscuous mode [ 371.302710] binder: release 5324:5328 transaction 31 out, still active [ 371.302715] binder: undelivered TRANSACTION_COMPLETE [ 371.307304] binder: BINDER_SET_CONTEXT_MGR already set [ 371.307312] binder: 5323:5330 ioctl 40046207 0 returned -16 03:35:39 executing program 4: seccomp(0x0, 0x1, &(0x7f0000000040)={0x2, &(0x7f0000000080)=[{0x6, 0xc8, 0x5, 0x7f}, {0x94b0, 0x6, 0xffffffff}]}) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={'bond0\x00'}) [ 371.313677] binder: send failed reply for transaction 31, target dead [ 371.313686] binder: send failed reply for transaction 32 to 5323:5330 [ 371.345489] binder: undelivered TRANSACTION_COMPLETE [ 371.345497] binder: undelivered TRANSACTION_ERROR: 29189 [ 371.388188] device lo entered promiscuous mode 03:35:39 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000040)) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) [ 371.398653] binder_alloc: 5334: binder_alloc_buf, no vma [ 371.405054] binder: 5334:5335 transaction failed 29189/-3, size 0-0 line 3136 [ 371.405809] device lo entered promiscuous mode [ 371.405874] device lo left promiscuous mode [ 371.438332] device lo entered promiscuous mode [ 371.438611] device lo left promiscuous mode [ 371.457133] device lo entered promiscuous mode [ 371.461356] device lo entered promiscuous mode [ 371.468446] device lo left promiscuous mode [ 371.545487] binder: undelivered TRANSACTION_ERROR: 29189 [ 372.568850] IPVS: Creating netns size=2536 id=83 [ 372.813432] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 372.827128] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 373.261333] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 373.275588] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 373.332246] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 373.347077] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 373.361136] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 373.375896] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 374.153933] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 374.190786] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 374.196954] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 374.203624] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:35:43 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:35:43 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x44fd, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x80000, 0x0) renameat(r0, &(0x7f0000000000)='./file0\x00', r1, &(0x7f0000000080)='./file0\x00') 03:35:43 executing program 4: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x80ffc) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:35:43 executing program 6: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) openat$md(0xffffffffffffff9c, &(0x7f0000000000)='/dev/md0\x00', 0x200, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:35:43 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:35:43 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[], 0x0) 03:35:43 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'veth1\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) bind(r0, &(0x7f0000000000)=@pppoe={0x18, 0x0, {0x4, @broadcast, 'team0\x00'}}, 0x80) r1 = syz_open_dev$usbmon(&(0x7f0000000080)='/dev/usbmon#\x00', 0x34, 0x0) ioctl$UI_SET_MSCBIT(r1, 0x40045568, 0x8) 03:35:43 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x81, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000340)='/dev/hwrng\x00', 0x400000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYBLOB="03000000000000002bbe5d03e9e855357ce86d702c73fa6466f32221ca4ae13418bd2902dac21b5b35bafee421ca3d53"], 0x1}}, 0x0) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200)='/dev/hwrng\x00', 0x4040, 0x0) getsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000280), 0x10) socket$packet(0x11, 0x3, 0x300) getsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f0000000400)={{{@in6=@remote, @in=@multicast2}}, {{@in=@remote}, 0x0, @in6=@loopback}}, &(0x7f0000000300)=0xe8) r7 = accept4$unix(r4, &(0x7f0000000500), &(0x7f0000000180)=0x6e, 0x800) accept4(r7, &(0x7f0000000580)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @broadcast}}}, &(0x7f00000003c0)=0x80, 0x80000) r8 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r8) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:35:43 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 375.266170] device lo left promiscuous mode [ 375.268864] binder_alloc: 5743: binder_alloc_buf, no vma [ 375.269009] binder: 5743:5748 transaction failed 29189/-3, size 0-0 line 3136 03:35:43 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 375.305853] binder: undelivered TRANSACTION_ERROR: 29189 [ 375.334124] binder_alloc: 5756: binder_alloc_buf, no vma [ 375.334143] binder: 5756:5757 transaction failed 29189/-3, size 0-0 line 3136 [ 375.360794] binder: undelivered TRANSACTION_ERROR: 29189 [ 375.391373] binder: 5763:5766 transaction failed 29189/-22, size 0-0 line 3013 [ 375.403534] device veth1 entered promiscuous mode [ 375.403988] device lo left promiscuous mode 03:35:43 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 375.495510] binder: undelivered TRANSACTION_ERROR: 29189 [ 375.537073] binder: 5771:5772 transaction failed 29189/-22, size 0-0 line 3013 03:35:43 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 375.595430] binder: undelivered TRANSACTION_ERROR: 29189 [ 375.632057] device lo entered promiscuous mode [ 375.636918] binder: 5774:5775 transaction failed 29189/-22, size 0-0 line 3013 03:35:43 executing program 5: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_inet_SIOCSIFBRDADDR(r0, 0x891a, &(0x7f0000000140)={'gre0\x00', {0x2, 0x4e23}}) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x800440040, 0x0) getsockopt$IP_VS_SO_GET_DESTS(r1, 0x0, 0x484, &(0x7f0000000240)=""/139, &(0x7f0000000040)=0x8b) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'bpq0\x00'}) ioctl$PERF_EVENT_IOC_DISABLE(r1, 0x2401, 0x1) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:35:43 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) r1 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x3, 0x8800) ioctl$SG_GET_TIMEOUT(r1, 0x2202, 0x0) 03:35:43 executing program 4: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = creat(&(0x7f0000000140)='./file0\x00', 0x4) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x2, 0x0) read$eventfd(r2, &(0x7f0000000040), 0x8) ioctl$ASHMEM_GET_NAME(r1, 0x81007702, &(0x7f0000000240)=""/255) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f0000007ac0)={{{@in, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6}}, &(0x7f0000007bc0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000007c00)={'team0\x00', r3}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000080)={'syzkaller0\x00'}) 03:35:43 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000001c0)={{{@in=@broadcast, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@dev}}, &(0x7f0000000000)=0xe8) setsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, [], 0x15}, @in6=@loopback, 0x4e22, 0x0, 0x4e21, 0xffffffffffffff01, 0x200000a, 0x20, 0x20, 0xbf, 0x0, r1}, {0x3, 0x5, 0x665f, 0x2, 0x8, 0x7, 0x8, 0x9}, {0xfff, 0x1, 0x6, 0xfffffffffffff9bc}, 0x200, 0x6e6bbe, 0x2, 0x1, 0x1, 0x2}, {{@in=@loopback, 0x4d5}, 0xa, @in6=@local, 0x3506, 0x4, 0x3, 0xffffffffffff4942, 0x9de, 0x1, 0x8}}, 0xe8) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000080)={0x0, @empty, @broadcast}, &(0x7f0000000100)=0xc) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140)='/dev/full\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x9, 0x10010, r2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={'bridge0\x00'}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_OUTPUT(r4, 0x2405, r3) [ 375.660841] device lo left promiscuous mode [ 375.718305] device lo entered promiscuous mode [ 375.724989] device lo left promiscuous mode [ 375.728753] device lo entered promiscuous mode 03:35:43 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) [ 375.734807] device lo left promiscuous mode [ 375.756271] device lo entered promiscuous mode [ 375.760149] device lo left promiscuous mode 03:35:43 executing program 7: perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 375.855710] binder: undelivered TRANSACTION_ERROR: 29189 03:35:43 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 375.954959] binder_alloc: 5803: binder_alloc_buf failed to map page at 20001000 in userspace [ 375.969286] binder: 5803:5805 transaction failed 29201/-12, size 0-0 line 3136 [ 375.977970] binder: undelivered TRANSACTION_ERROR: 29201 [ 376.027344] device lo entered promiscuous mode [ 376.033485] device lo entered promiscuous mode [ 376.041044] device lo entered promiscuous mode [ 376.048492] device lo left promiscuous mode [ 376.175481] IPVS: Creating netns size=2536 id=84 [ 376.353296] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 376.367399] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 376.448367] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 376.462100] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 376.519316] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 376.532432] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 376.547579] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 376.562765] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 377.243410] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 377.277419] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 377.283523] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 377.291011] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 378.588774] IPVS: Creating netns size=2536 id=85 [ 378.763248] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 378.777148] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 378.857707] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 378.871246] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 378.952336] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 378.967186] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 378.981153] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 378.996682] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 379.667486] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 379.701898] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 379.708261] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 379.714894] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:35:47 executing program 6: mkdir(&(0x7f0000000000)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000040)={0x7, 0x4d, 0x1fffffffffffc}, 0x7) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000340)='9p\x00', 0x0, &(0x7f00000006c0)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@version_u='version=9p2000.u'}]}}) write$P9_RREADDIR(r1, &(0x7f0000000480)=ANY=[@ANYBLOB="2a0000002901000000000000000000000000000000000000fe000000bc4f00000007002e2f66696c6530"], 0x2a) write$P9_RGETATTR(r1, &(0x7f0000000200)={0xa0, 0x19, 0x1}, 0xa0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000180)='9p\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="81c8bf93852c7266646e6f3d000000", @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB=',nodevmap,\x00']) ioctl$KIOCSOUND(r0, 0x4b2f, 0x4) write$P9_RCLUNK(r1, &(0x7f0000000140)={0x7, 0x79, 0x2}, 0x7) vmsplice(r0, &(0x7f0000000440)=[{&(0x7f0000000640)="ad2bb8c0df1f14bae6473b0ff3e8043d3ba2b766d05643f6e2e0b58a7941ac46e012d83c49a70362a4610b88c78ea0fff150245f1656d63a72f8ed4eca", 0x3d}], 0x1, 0x0) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$ARPT_SO_GET_ENTRIES(r2, 0x0, 0x61, &(0x7f00000005c0)=ANY=[], &(0x7f0000000400)) ioctl$RTC_ALM_SET(r2, 0x40247007, &(0x7f00000004c0)={0x35, 0x17, 0x6, 0x10, 0x0, 0x800, 0x5, 0x8f, 0xffffffffffffffff}) chmod(&(0x7f0000000500)='./file0/file0\x00', 0x0) 03:35:47 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:35:47 executing program 4: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x20, 0x0) socket$inet(0x2, 0x3, 0x200) r1 = getegid() r2 = getegid() setregid(r1, r2) ioctl$BLKFLSBUF(r0, 0x1261, &(0x7f0000000080)) 03:35:47 executing program 3: times(&(0x7f0000000340)) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000180)={0xffffffffffffffff}) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, &(0x7f0000000300)='team_slave_0\x00') r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000580)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r4 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000380)='/selinux/enforce\x00', 0x40000000008004, 0x0) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB="030000c1326bb40008001b000000207d0d3ca14b00b135ebc6b23e72cc0800000000000000169d9e36b5dc52157fa5695afcf4ade9923e30b3664c8a4f640c59acdeb14fd7d8fb02d51451a9e2d5b31517b082df2b7034c51d18e5cb4f069900000000000000041f494bfd7cc690fbbc75151ace13548a061c3451c8a8b2d6871879e3d68be62450c1bb6d719428ced5dd81057618cdb5ad563abda57c51e09d250dac1341557dae14d096047b7b7309fb32ba5b0b1bba1dde4069063e53c381e65495d991a32532e93d176097eb04d76c7038e200000000000000000000000000000000000000000000000023476f7a71a76cc9239f57b92d132c19da370ff71f31bb7ca15838f0e77c9204187e15b1dc29b2b527b3a749c7edc597a6ea2d5377539b6e5c58faea1b2064ef6eb3e9"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) r7 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r7) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000000280)={0x8, &(0x7f0000000200)=[{0x26a, 0x52, 0x3, 0x3}, {0x7ff, 0x1, 0x6a7, 0x7}, {0x1, 0x6, 0x899, 0x3}, {0x3, 0x1, 0x6}, {0x80, 0xc8a, 0x7fff, 0x3}, {0x8, 0x5, 0x100000000, 0x7}, {0x9, 0xa02, 0x9, 0xc70}, {0x1, 0x7b, 0x165, 0x3}]}, 0x10) write$P9_RAUTH(r7, &(0x7f00000002c0)={0x14, 0x67, 0x2, {0x6f, 0x0, 0x8}}, 0x14) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r5, 0x40505412, &(0x7f0000000400)={0x5, 0x2, 0x2000000000, 0x0, 0x7}) 03:35:47 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[], 0x0) 03:35:47 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) socketpair$inet6_icmp_raw(0xa, 0x3, 0x3a, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={'lo\x00@\x00', 0x105}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:35:47 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_int(r0, 0x0, 0x3f, &(0x7f0000000000), &(0x7f0000000040)=0x4) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:35:47 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(0xffffffffffffffff) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) [ 379.986559] device lo entered promiscuous mode [ 379.993424] device lo left promiscuous mode 03:35:47 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 380.061776] 9pnet_virtio: no channels available for device (null) [ 380.071928] binder_alloc: 6566: binder_alloc_buf, no vma 03:35:47 executing program 4: r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000340)=0x3, 0x4) sendto$inet6(r0, &(0x7f0000000080), 0x0, 0x0, &(0x7f0000000000)={0xa, 0x0, 0x2000000000d, @mcast2}, 0x1c) [ 380.071944] binder: 6566:6573 transaction failed 29189/-3, size 0-0 line 3136 03:35:48 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) openat$selinux_create(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/create\x00', 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f00000001c0)={'filter\x00', 0x7, 0x4, 0x478, 0x138, 0x0, 0x138, 0x390, 0x390, 0x390, 0x4, &(0x7f0000000000), {[{{@uncond, 0xf0, 0x138}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xca4, 'syz0\x00', 0x200}}}, {{@uncond, 0xf0, 0x118}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x800, 0x7}}}, {{@arp={@broadcast, @loopback, 0x0, 0xff000000, @mac=@remote, {[0xff, 0xff]}, @empty, {[0xff, 0xff, 0xff, 0xff, 0xff]}, 0x8, 0xffffffffffffffff, 0x0, 0xad31, 0x7, 0x800, 'veth1_to_bridge\x00', 'bond0\x00', {}, {0x2ac0903882b0adb2}}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@dev={[], 0x18}, @loopback, @loopback, 0xf, 0x1}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4c8) 03:35:48 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x10, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:35:48 executing program 4: sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x40000, 0x48) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000440)={0x2, 0xbf3, 0x6, 0x3ff}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$mice(&(0x7f0000000280)='/dev/input/mice\x00', 0x0, 0x80) ioctl$TIOCCBRK(r1, 0x5428) r2 = socket(0x10, 0x803, 0x0) r3 = memfd_create(&(0x7f0000000500)='\x00?\x00\x00\x00\x00\x00\x00\x00', 0x7) ioctl$UFFDIO_COPY(r3, 0xc028aa03, &(0x7f0000000140)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x2000)=nil, 0x4000, 0x1}) fcntl$getownex(r2, 0x10, &(0x7f0000000180)={0x0, 0x0}) sched_getparam(r4, &(0x7f00000001c0)) setsockopt$inet_group_source_req(r1, 0x0, 0x2e, &(0x7f00000002c0)={0x2, {{0x2, 0x4e20, @multicast1}}, {{0x2, 0x4e24, @broadcast}}}, 0x36a) sendto(r2, &(0x7f0000000200)="120000001600e70d017b000000977dc630a8d3fa06113fc6000000005994727322285ce45220d5b25b48fa7ca603c47de657ac08e98d84809e5192d3ec3e000000fece6a895e1726712d65256ef04f2e95fbf509000000224cdad14a33d48bef47", 0x61, 0xfffffffffffffffc, 0x0, 0x0) [ 380.072116] binder: undelivered TRANSACTION_ERROR: 29189 [ 380.092564] device lo left promiscuous mode [ 380.098293] device lo entered promiscuous mode 03:35:48 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 380.106579] device lo left promiscuous mode [ 380.141511] binder_alloc: 6582: binder_alloc_buf, no vma [ 380.141530] binder: 6582:6583 transaction failed 29189/-3, size 0-0 line 3136 03:35:48 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:35:48 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 380.141923] binder: undelivered TRANSACTION_ERROR: 29189 [ 380.206341] binder_alloc: 6595: binder_alloc_buf, no vma [ 380.206360] binder: 6595:6597 transaction failed 29189/-3, size 0-0 line 3136 [ 380.206530] binder: undelivered TRANSACTION_ERROR: 29189 [ 380.256686] binder_alloc: 6603: binder_alloc_buf, no vma [ 380.256704] binder: 6603:6604 transaction failed 29189/-3, size 0-0 line 3136 [ 380.256870] binder: undelivered TRANSACTION_ERROR: 29189 [ 380.306731] binder_alloc: 6607: binder_alloc_buf, no vma [ 380.306749] binder: 6607:6610 transaction failed 29189/-3, size 0-0 line 3136 [ 380.307312] binder: undelivered TRANSACTION_ERROR: 29189 [ 380.367593] binder_alloc: 6612: binder_alloc_buf, no vma [ 380.367613] binder: 6612:6613 transaction failed 29189/-3, size 0-0 line 3136 [ 380.367794] binder: undelivered TRANSACTION_ERROR: 29189 03:35:48 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:35:48 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") r1 = syz_open_dev$binder(&(0x7f0000001000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = syz_open_dev$binder(&(0x7f000000fff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000012000)={0x8, 0x0, &(0x7f0000005fd4)=[@acquire], 0x0, 0x0, &(0x7f0000012fc7)}) accept$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000000100)=0x1c) close(r1) dup(r2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000200)={0x44, 0x0, &(0x7f0000000140)=[@clear_death={0x400c630f, 0x2, 0x1}, @request_death={0x400c630e, 0x0, 0x1}, @request_death={0x400c630e, 0x2, 0x3}, @acquire, @exit_looper, @decrefs={0x40046307, 0x1}], 0x1f, 0x0, &(0x7f00000001c0)="bae28b54c2db0911c862d4f3ebf430b995244ffdeeaceb9384919e70945532"}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00'], 0x0, 0x0, &(0x7f00000001c0)}) [ 380.443282] 9pnet_virtio: no channels available for device (null) 03:35:48 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 380.496571] binder: release 6617:6619 transaction 58 out, still active [ 380.505293] binder: undelivered TRANSACTION_COMPLETE [ 380.524301] binder: send failed reply for transaction 58, target dead [ 380.544495] device lo entered promiscuous mode [ 380.551376] binder: 6618:6625 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 380.558226] device lo left promiscuous mode [ 380.567350] device lo entered promiscuous mode [ 380.572584] binder: 6618:6625 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 380.575522] binder: release 6622:6624 transaction 62 out, still active [ 380.575526] binder: undelivered TRANSACTION_COMPLETE [ 380.579704] device lo left promiscuous mode [ 380.585556] binder: send failed reply for transaction 62, target dead [ 380.602556] binder: 6618:6620 unknown command 0 [ 380.607296] binder: 6618:6620 ioctl c0306201 20000040 returned -22 [ 380.640901] binder: 6618:6625 DecRefs 0 refcount change on invalid ref 1 ret -22 03:35:48 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r5) ioctl$SG_SET_KEEP_ORPHAN(r4, 0x2287, &(0x7f0000000200)) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) [ 380.743834] device lo entered promiscuous mode [ 380.750955] device lo left promiscuous mode 03:35:48 executing program 4: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200)='/dev/net/tun\x00', 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000340)={0x0}, &(0x7f0000000380)=0xc) waitid(0x3, r1, &(0x7f00000003c0), 0x60000000, &(0x7f0000000400)) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) ioctl$sock_FIOGETOWN(0xffffffffffffff9c, 0x8903, &(0x7f00000002c0)=0x0) ptrace$peek(0x3, r2, &(0x7f0000000300)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'eql\x00', 0x2029}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x20000000308) r3 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180)='/dev/hwrng\x00', 0x0, 0x0) getsockopt$inet6_int(r3, 0x29, 0x3f, &(0x7f0000000240), &(0x7f0000000280)=0x4) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2800000010c7e22de4b07fcd170005624f00000000000000", @ANYRES32=0x0, @ANYBLOB="030000000000000008001b0000000000"], 0x28}}, 0x0) 03:35:48 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:35:48 executing program 5: r0 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x40000, 0x0) getpeername(r0, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000140)=0x80) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) [ 380.897872] binder: release 6642:6646 transaction 64 out, still active [ 380.907268] binder: undelivered TRANSACTION_COMPLETE [ 380.916414] binder: send failed reply for transaction 64, target dead [ 380.923061] device lo entered promiscuous mode [ 380.943110] device lo left promiscuous mode [ 380.949049] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=50960 sclass=netlink_route_socket pig=6643 comm=syz-executor4 [ 381.040559] device lo entered promiscuous mode [ 381.046586] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=50960 sclass=netlink_route_socket pig=6650 comm=syz-executor4 [ 381.291778] binder: 6618:6620 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 381.298767] binder: 6618:6620 BC_REQUEST_DEATH_NOTIFICATION invalid ref 2 [ 381.299257] binder: 6618:6655 unknown command 0 [ 381.299267] binder: 6618:6655 ioctl c0306201 20000040 returned -22 [ 381.317540] binder: 6618:6620 DecRefs 0 refcount change on invalid ref 1 ret -22 [ 381.890341] IPVS: Creating netns size=2536 id=86 [ 382.060977] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 382.075084] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 382.131707] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 382.144871] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 382.200503] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 382.214174] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 382.228149] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 382.242913] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 382.886373] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 382.921181] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 382.927423] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 382.934038] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:35:51 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(0xffffffffffffffff) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:35:51 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) socketpair$inet(0x2, 0x806, 0x5, &(0x7f0000000000)) 03:35:51 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x0) 03:35:51 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:35:51 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x100) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'lo\x00@\x00', 0x100000000004100}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:35:51 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) creat(&(0x7f0000000200)='./file0\x00', 0x2) 03:35:51 executing program 4: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_int(r0, 0x0, 0x3f, &(0x7f0000000000), &(0x7f0000000040)=0x4) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:35:51 executing program 6: perf_event_open(&(0x7f000001d000)={0x200000002, 0x70, 0x3, 0x108000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x800, 0x0) r0 = open(&(0x7f00009e1000)='./file0\x00', 0xc007d1bed8eee74, 0xfffffffffffffffc) iopl(0xe460) fcntl$setlease(r0, 0x400, 0x0) 03:35:51 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 383.979267] device lo entered promiscuous mode [ 383.992552] device lo left promiscuous mode [ 383.996322] binder: 7032:7042 transaction failed 29189/-22, size 0-0 line 3013 [ 383.996477] binder: undelivered TRANSACTION_ERROR: 29189 03:35:51 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:35:51 executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(0xffffffffffffffff) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) [ 384.030466] binder: 7048:7049 transaction failed 29189/-22, size 0-0 line 3013 [ 384.040045] binder: undelivered TRANSACTION_ERROR: 29189 03:35:51 executing program 7: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 384.088848] binder: 7059:7061 transaction failed 29189/-22, size 0-0 line 3013 [ 384.098261] binder: undelivered TRANSACTION_ERROR: 29189 03:35:52 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:35:52 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:35:52 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:35:52 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) r1 = syz_open_dev$sndseq(&(0x7f0000000200)='/dev/snd/seq\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f0000000140)={0x0, 0x0, 0x0, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TEMPO(r1, 0xc02c5341, &(0x7f0000000240)) fcntl$dupfd(r0, 0x406, r0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) [ 384.201422] device lo entered promiscuous mode [ 384.213153] device lo left promiscuous mode [ 384.222049] device lo left promiscuous mode [ 384.228806] device lo left promiscuous mode 03:35:52 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={"6c6f00000000000000000000000200", 0x1800}) ioctl$LOOP_SET_FD(r0, 0x4c00, r0) 03:35:52 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(0xffffffffffffffff) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) [ 384.312666] device lo entered promiscuous mode [ 384.317388] device lo left promiscuous mode [ 384.321827] device lo entered promiscuous mode [ 384.332064] device lo left promiscuous mode [ 384.340230] device lo entered promiscuous mode [ 384.346534] device lo left promiscuous mode [ 384.389638] device lo entered promiscuous mode [ 384.397629] device lo left promiscuous mode [ 384.509796] device lo entered promiscuous mode 03:35:52 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$EBT_SO_GET_INFO(r0, 0x0, 0x80, &(0x7f0000000000)={'broute\x00'}, &(0x7f0000000100)=0xf4) fcntl$getownex(r0, 0x10, &(0x7f00000002c0)={0x0, 0x0}) fcntl$setownex(r0, 0xf, &(0x7f0000000300)={0x0, r1}) r2 = dup(r0) ioctl$SG_GET_PACK_ID(r2, 0x227c, &(0x7f0000000140)) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000003c0)={'nr0\x00', 0x101}) sendto$inet(r0, &(0x7f00000001c0)="819ff2d67ce4a70b6b5e13a8923583c6405a5f921e046c86eaf89d18182f768397f9e6f4680401674d87b5d1a8d9d8589412c5b62c33d5e995dc51bb58505a86c848a4e63cdb08e1acbc682f2c8eaf1fde79b15f0450604dcd9fcb3a6364cae9c46b46376d3b9664c2937c39c1af2fd2e1c3610a146cdb4238e975039915b6a12286ab3cb1d9771487772cbb5dff9561b9155a4ac55674382475cf2f52f3004151bb62872568b488401578c232cbf3ee32f1a1a645c688f00a13efbb3cf09f19df05a75dca001237c118f16bc8820c9bc6bcf8cc60bfe76642dc371d4df7e27fbf033eadb6441a1a3df6039c9755049ce2", 0xf1, 0x0, &(0x7f0000000080)={0x2, 0x1, @remote}, 0x10) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:35:52 executing program 7: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) socketpair$inet(0x2, 0x806, 0x5, &(0x7f0000000000)) 03:35:52 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(0xffffffffffffffff) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:35:52 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x0) 03:35:52 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000000)) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:35:52 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340)='/dev/net/tun\x00', 0x8480, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r2 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) accept4$packet(r3, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000280)=0x14, 0x800) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f00000002c0)={@dev={0xfe, 0x80, [], 0x16}, @mcast2, @loopback, 0x9, 0x401, 0xd2e, 0x400, 0x80000001, 0x4c20000, r4}) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x20000, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r5) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r0) [ 384.808847] device lo entered promiscuous mode [ 384.818700] device lo left promiscuous mode 03:35:52 executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(0xffffffffffffffff) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:35:52 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) [ 384.958474] device lo left promiscuous mode 03:35:52 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) keyctl$session_to_parent(0x12) r2 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x8000) ioctl$UFFDIO_UNREGISTER(r2, 0x8010aa01, &(0x7f0000000080)={&(0x7f0000003000/0x1000)=nil, 0x1000}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x40800, 0x0) write$9p(r3, &(0x7f0000000140)="09655564a78b27230a9d54e4cf551ac7c094ac51b8052e44b617dbcfc6b97dfc48bc59fa7a1210c209f9ad56707acb8c9f9a7f80718f81ff46476bf0031b6050f90e7d30c3888f3346ad70caec4f587e9de48d389ae74b04abb401e7a1ef5fb9aaee666473f9cefd5092010f09f41fc12da9a316f9d266d99bc6deebd48728e583942bb05dfaaf5c5e6d37d42c2895ef96bbfb0f6bfe22532015a42414778017c2c99d1914f93482af13f19fb3aec45bf00b8fbd1f20deea2d8d0bbe3878ee6028362856d4931a656a25ad145a57e90aa02faeea6b7114", 0xd7) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 384.985240] device lo entered promiscuous mode [ 384.996703] device lo left promiscuous mode [ 385.009853] binder: 7130:7132 got transaction to context manager from process owning it [ 385.023266] binder: 7130:7132 transaction failed 29201/-22, size 0-0 line 3004 03:35:52 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000240)={{{@in6, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in6=@mcast1}}, &(0x7f0000000080)=0xe8) connect(r0, &(0x7f0000000140)=@can={0x1d, r1}, 0x80) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000000)={"6c6f00000000000000000000000200", 0x8000}) 03:35:52 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) ioctl$EVIOCSREP(r0, 0x40084503, &(0x7f0000000000)=[0x3, 0x9]) [ 385.045361] binder_alloc: binder_alloc_mmap_handler: 7130 20001000-20004000 already mapped failed -16 [ 385.055045] binder: BINDER_SET_CONTEXT_MGR already set [ 385.064190] binder: 7130:7133 ioctl 40046207 0 returned -16 [ 385.070761] binder_alloc: 7130: binder_alloc_buf, no vma [ 385.076529] binder: 7130:7133 transaction failed 29189/-3, size 0-0 line 3136 03:35:53 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 385.100164] binder: undelivered TRANSACTION_ERROR: 29201 [ 385.108655] device lo entered promiscuous mode [ 385.117449] device lo entered promiscuous mode [ 385.123797] device lo left promiscuous mode [ 385.135871] binder: undelivered TRANSACTION_ERROR: 29189 [ 385.188742] binder_alloc: 7142: binder_alloc_buf failed to map page at 20001000 in userspace [ 385.204871] binder: 7142:7143 transaction failed 29201/-12, size 0-0 line 3136 [ 385.225293] binder_alloc: binder_alloc_mmap_handler: 7142 20001000-20004000 already mapped failed -16 03:35:53 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) write$cgroup_subtree(r0, &(0x7f0000000000)={[{0x2f, 'rdma'}, {0x2f, 'memory'}, {0x2b, 'memory'}, {0x2d, 'rdma'}, {0x2b, 'rdma'}, {0x2d, 'memory'}, {0x2f, 'rdma'}, {0x2f, 'memory'}]}, 0x38) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:35:53 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x1000001, 0x0) ioctl$TIOCSCTTY(r1, 0x540e, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) syz_mount_image$iso9660(&(0x7f0000000000)='iso9660\x00', &(0x7f0000000100)='./file0\x00', 0x9, 0x2, &(0x7f0000000140)=[{&(0x7f00000001c0)="7e9b55338d6d7bfa85fe6ce233c75634d090813192db9158cc1eef828b43bb1653ff344ac440a041f4549443e8fca1c287f4a9767f1f08dc623b3a981e7441b50513f2d2ec97ecbe65898328a44ab125c82f5f2b855c9673d4cacf9e1b007b9f0f94756c", 0x64}, {&(0x7f0000000240)="1bd28963b309b725eac2570525dc5b43cd27fe9669b83bc8d0f32fe02bb5c8e548a0b5ba513f5bba79627ead1f0e5952dc3ed526585bd5c822227c3cbe2adc5edbfecbd46c5aa09dd1b9853aa02a84b8aeb89f2418864e21d572d6d0b8e119d9b4b7", 0x62, 0x400}], 0x400, &(0x7f00000002c0)={[{@norock='norock'}, {@mode={'mode', 0x3d, 0xc3}}]}) ioctl$TIOCSSOFTCAR(r1, 0x541a, &(0x7f0000000040)=0x7) 03:35:53 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) r2 = socket$netlink(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000100)={0x2000000005, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @perf_bp={&(0x7f0000000000), 0x1}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r2, 0x10e, 0x1, &(0x7f0000000080), 0xff32) getsockopt$netlink(r2, 0x10e, 0x9, &(0x7f0000000000)=""/4, &(0x7f0000000280)=0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 385.243869] binder: BINDER_SET_CONTEXT_MGR already set [ 385.249235] device lo left promiscuous mode [ 385.253984] binder: 7142:7144 ioctl 40046207 0 returned -16 [ 385.265262] binder: undelivered TRANSACTION_ERROR: 29201 [ 385.287345] device lo entered promiscuous mode [ 385.298148] device lo left promiscuous mode [ 385.327347] binder_alloc: 7150: binder_alloc_buf failed to map page at 20001000 in userspace [ 385.347255] binder: 7150:7154 transaction failed 29201/-12, size 0-0 line 3136 [ 385.375333] binder_alloc: binder_alloc_mmap_handler: 7150 20001000-20004000 already mapped failed -16 [ 385.379381] device lo entered promiscuous mode [ 385.389862] device lo left promiscuous mode [ 385.398119] isofs_fill_super: bread failed, dev=loop1, iso_blknum=16, block=32 [ 385.413587] binder: BINDER_SET_CONTEXT_MGR already set [ 385.419645] binder: 7150:7156 ioctl 40046207 0 returned -16 [ 385.426291] binder: undelivered TRANSACTION_ERROR: 29201 [ 385.438559] device lo entered promiscuous mode [ 385.445012] device lo left promiscuous mode [ 385.473775] IPVS: Creating netns size=2536 id=87 [ 385.698704] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 385.712470] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 385.809340] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 385.828925] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 385.888536] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 385.902062] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 385.916185] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 385.931271] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 386.600820] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 386.634637] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 386.640789] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 386.648142] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:35:55 executing program 5: r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x1, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000140)={0x0}, &(0x7f00000001c0)=0xc) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x10000, 0x1000, 0x2, 0x400, 0x0, 0x70c, 0x2000, 0x0, 0x2, 0xfffffffffffffffa, 0x2, 0xffffffff80000001, 0x2, 0x8, 0x2, 0x7, 0x5a01, 0x23ef, 0x8, 0x3, 0x8, 0x8, 0x5, 0x200, 0x800, 0x9c0, 0xfff, 0x40, 0x7, 0x5ad, 0xe71, 0x80, 0x8, 0x910a, 0x6, 0x200, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000000), 0x8}, 0x40, 0x7, 0x1, 0x3, 0x9, 0x80, 0x9}, r2, 0x2, r0, 0x9) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:35:55 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="0310000000000000f7ff130000000086ad0149ba040d2c39cdddbacd03dcdc84bdf2655632fd752df409aab3802d5ec5272d4448dd5e7760b9193fafe8b5164795a715be66b03f55f52337261f95cb5f6fe472eb280a712ade5bacbb70ed5d969b8ea7da5db09b99091e921b07a811e2b434b44ec5167bb3650c3ab06d84f84c36096c70b37f81cd514b240b86b2a647535ff5c8f8bc5b1fe11447655ebec76612fbf94208cd813b81a5ed94767daef17e11b647"], 0x1}}, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000180)='/dev/hwrng\x00', 0x101080, 0x0) setsockopt$inet_int(r4, 0x0, 0x3f, &(0x7f0000000200)=0x9, 0x4) socket$packet(0x11, 0x3, 0x300) r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r5) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:35:55 executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(0xffffffffffffffff) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:35:55 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(0xffffffffffffffff, &(0x7f0000001000), 0x1000) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(0xffffffffffffffff, &(0x7f0000001000), 0x1000) 03:35:55 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) syz_open_dev$binder(&(0x7f0000000180)='/dev/binder#\x00', 0x0, 0x802) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000000)={{{@in6=@loopback, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@ipv4={[], [], @multicast1}}}, &(0x7f0000000140)=0xe8) ioprio_get$uid(0x3, r2) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:35:55 executing program 1: r0 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x2, 0x0) setsockopt$sock_void(r0, 0x1, 0x24, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f0000000000)={'bridge_slave_0\x00', 0x4}) 03:35:55 executing program 4: socket$packet(0x11, 0x3, 0x300) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x101040, 0x0) ioctl$ASHMEM_GET_PIN_STATUS(r0, 0x7709, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) mount(&(0x7f0000000240)='./file0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f0000000200)='cgroup2\x00', 0x0, 0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x0) openat$cgroup_procs(r1, &(0x7f0000000300)="6367726f75702e70726f6373000b816949100445531497cdb3bcf18cfa7befd92197483ab23b662fbd9615b57228cfe5fc881ed993baac961bd7d3b4c1d38bf073c41a23e5ac82eb7425e3635009c0ce521d9875e63f3f8b4ff5de3e23861fec6308649ac95e2eb7e5ade9e2fc9af80569", 0x2, 0x0) epoll_create(0x2) pselect6(0x40, &(0x7f0000000140), &(0x7f0000000180), &(0x7f0000000380)={0x7f}, &(0x7f0000000400), &(0x7f0000000480)={&(0x7f0000000440), 0x8}) 03:35:55 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB], 0x0) [ 387.715584] device lo entered promiscuous mode [ 387.727959] binder_alloc: 7539: binder_alloc_buf failed to map page at 20001000 in userspace 03:35:55 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) r2 = syz_open_dev$usbmon(&(0x7f0000000000)='/dev/usbmon#\x00', 0x9, 0x8000) read$eventfd(r2, &(0x7f0000000040), 0x8) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 387.728007] binder: 7539:7548 transaction failed 29201/-12, size 0-0 line 3136 [ 387.742914] binder_alloc: binder_alloc_mmap_handler: 7539 20001000-20004000 already mapped failed -16 03:35:55 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = getpid() r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000280)='/selinux/avc/cache_stats\x00', 0x0, 0x0) accept4$packet(r3, 0x0, &(0x7f00000002c0), 0x800) sched_setaffinity(r2, 0x8, &(0x7f0000000180)=0x4) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r5 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffffa) ioctl$PPPIOCGFLAGS(r4, 0x8004745a, &(0x7f00000001c0)) add_key(&(0x7f0000000000)='rxrpc_s\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a, 0x3}, 0x0, 0x0, r5) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="80634040000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000dd5f013c7d", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 387.744082] binder: BINDER_SET_CONTEXT_MGR already set 03:35:55 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r2, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) sendfile(r2, r2, &(0x7f0000317000), 0xff8) quotactl(0x0, &(0x7f0000000040)='./file0/file0\x00', 0x0, &(0x7f0000000100)) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_tcp(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x8000, &(0x7f00000001c0)={'trans=tcp,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@nodevmap='nodevmap'}, {@privport='privport'}, {@privport='privport'}, {@access_uid={'access', 0x3d, r3}}, {@aname={'aname', 0x3d, '/dev/binder#\x00'}}, {@access_user='access=user'}, {@version_L='version=9p2000.L'}]}}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 387.744090] binder: 7539:7548 ioctl 40046207 0 returned -16 [ 387.744700] binder_alloc: 7539: binder_alloc_buf, no vma [ 387.744717] binder: 7539:7549 transaction failed 29189/-3, size 0-0 line 3136 [ 387.745266] binder: undelivered TRANSACTION_ERROR: 29189 [ 387.745340] binder: undelivered TRANSACTION_ERROR: 29201 [ 387.802373] binder_alloc: 7555: binder_alloc_buf failed to map page at 20001000 in userspace 03:35:55 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) stat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = add_key$keyring(&(0x7f00000001c0)='keyring\x00', &(0x7f0000000200)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffffa) keyctl$get_persistent(0x16, r2, r3) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000000)={0xffffffffffffffff}) getsockopt$IP_VS_SO_GET_TIMEOUT(r4, 0x0, 0x486, &(0x7f0000000040), &(0x7f0000000080)=0xc) [ 387.802405] binder: 7555:7556 transaction failed 29201/-12, size 0-0 line 3136 [ 387.807706] binder_alloc: binder_alloc_mmap_handler: 7555 20001000-20004000 already mapped failed -16 [ 387.807956] binder: BINDER_SET_CONTEXT_MGR already set 03:35:55 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 387.807964] binder: 7555:7557 ioctl 40046207 0 returned -16 [ 387.808057] binder_alloc: 7555: binder_alloc_buf, no vma [ 387.808074] binder: 7555:7556 transaction failed 29189/-3, size 0-0 line 3136 03:35:55 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) pwrite64(r1, &(0x7f0000000080)="3c9aea2c9ad4608436f510e29b2fa4003a88a00a245400b250db3c9259723535c160401f4a950939c1914288fa55a52fad2ea59a34cfa8626168839669961f221043", 0x42, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0x1, 0x0) ioctl$SG_GET_NUM_WAITING(r2, 0x227d, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 387.808385] binder: undelivered TRANSACTION_ERROR: 29189 [ 387.808462] binder: undelivered TRANSACTION_ERROR: 29201 [ 387.854160] binder: 7562:7563 unknown command 1077961600 03:35:55 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x400000000000) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 387.854171] binder: 7562:7563 ioctl c0306201 20000440 returned -22 [ 387.863809] binder: BINDER_SET_CONTEXT_MGR already set [ 387.863817] binder: 7562:7563 ioctl 40046207 0 returned -16 [ 387.927272] binder: 7566:7567 ioctl c0306201 20000440 returned -14 03:35:56 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0xffffffffffffffff, 0x1000) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) madvise(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x8008) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0063384000000000000000000000000000000000000000004db3f7dd40800000000000000000000000000000000000060000d4f335915f1a21743f9ae8209efc8fa8d1e3c52106c523493c", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) socket$inet6(0xa, 0x6, 0x0) [ 387.933477] binder_alloc: binder_alloc_mmap_handler: 7566 20001000-20004000 already mapped failed -16 [ 387.934509] binder: BINDER_SET_CONTEXT_MGR already set [ 387.934516] binder: 7566:7567 ioctl 40046207 0 returned -16 [ 387.934890] binder: 7566:7567 ioctl c0306201 20000440 returned -14 [ 387.985770] binder_alloc: 7570: binder_alloc_buf failed to map page at 20001000 in userspace [ 387.985804] binder: 7570:7571 transaction failed 29201/-12, size 0-0 line 3136 [ 387.990855] binder_alloc: binder_alloc_mmap_handler: 7570 20001000-20004000 already mapped failed -16 [ 387.997931] binder: BINDER_SET_CONTEXT_MGR already set [ 387.997942] binder: 7570:7571 ioctl 40046207 0 returned -16 [ 387.998910] binder_alloc: 7570: binder_alloc_buf, no vma [ 387.998927] binder: 7570:7572 transaction failed 29189/-3, size 0-0 line 3136 [ 388.000364] binder: undelivered TRANSACTION_ERROR: 29189 [ 388.000422] binder: undelivered TRANSACTION_ERROR: 29201 [ 388.026179] binder_alloc: 7573: binder_alloc_buf failed to map page at 20001000 in userspace [ 388.034633] binder: 7573:7575 transaction failed 29201/-12, size 0-0 line 3136 [ 388.050349] binder_alloc: binder_alloc_mmap_handler: 7573 20001000-20004000 already mapped failed -16 [ 388.051434] binder: BINDER_SET_CONTEXT_MGR already set [ 388.051442] binder: 7573:7576 ioctl 40046207 0 returned -16 [ 388.051856] binder: undelivered TRANSACTION_ERROR: 29201 [ 388.090967] binder_alloc: 7578: binder_alloc_buf failed to map page at 20001000 in userspace [ 388.102813] binder: 7578:7579 transaction failed 29201/-12, size 0-0 line 3136 [ 388.115419] binder: BINDER_SET_CONTEXT_MGR already set [ 388.115427] binder: 7578:7579 ioctl 40046207 0 returned -16 [ 388.122065] binder_alloc: 7578: binder_alloc_buf, no vma [ 388.122081] binder: 7578:7580 transaction failed 29189/-3, size 0-0 line 3136 [ 388.122436] binder: undelivered TRANSACTION_ERROR: 29189 [ 388.122510] binder: undelivered TRANSACTION_ERROR: 29201 [ 388.145749] binder_alloc: 7581: binder_alloc_buf failed to map page at 20001000 in userspace [ 388.145794] binder: 7581:7583 transaction failed 29201/-12, size 0-0 line 3136 [ 388.150066] binder_alloc: binder_alloc_mmap_handler: 7581 20001000-20004000 already mapped failed -16 [ 388.150163] binder: BINDER_SET_CONTEXT_MGR already set [ 388.150171] binder: 7581:7584 ioctl 40046207 0 returned -16 [ 388.150541] binder: undelivered TRANSACTION_ERROR: 29201 [ 388.189785] binder: 7586:7587 unknown command 1077437184 [ 388.189808] binder: 7586:7587 ioctl c0306201 20000440 returned -22 [ 388.230122] binder_alloc: binder_alloc_mmap_handler: 7586 20001000-20004000 already mapped failed -16 [ 388.231190] binder: BINDER_SET_CONTEXT_MGR already set [ 388.231198] binder: 7586:7587 ioctl 40046207 0 returned -16 [ 388.232228] binder: 7586:7590 unknown command 1077437184 [ 388.232236] binder: 7586:7590 ioctl c0306201 20000440 returned -22 [ 388.476910] device lo entered promiscuous mode [ 388.485057] device lo left promiscuous mode [ 388.492165] device lo left promiscuous mode [ 388.585496] device lo entered promiscuous mode [ 388.591728] device lo left promiscuous mode [ 388.597392] device lo entered promiscuous mode [ 388.604823] device lo left promiscuous mode 03:35:56 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000280)={0xc, 0x0, &(0x7f0000000240)=[@increfs={0x40046304, 0x4}, @exit_looper], 0x82, 0x0, &(0x7f0000000380)="5fab4966ad94b3fd9e221f6de5d578a389d360124096b311fedab984f75a32759a00f75943c6c72ddf575c0da7ab29c981488beb8a33e7f9676ac9ac649dfbe27af73c982ec99633af0eb9b9d1acb7d3e3857157629b8af9874590fc0b3b0329b555c8d51de04cd89e9c243fbcfd32fc71dc602d8f0c4e8ec847e4102fad0eca856b"}) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$LOOP_GET_STATUS64(r2, 0x4c05, &(0x7f0000000140)) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) rt_sigprocmask(0x1, &(0x7f0000000040)={0x4}, &(0x7f0000000080), 0x8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) ioctl$RTC_AIE_ON(r3, 0x7001) [ 388.672922] IPVS: Creating netns size=2536 id=88 [ 388.678976] binder: 7599:7602 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 388.697881] binder_alloc: 7599: binder_alloc_buf failed to map page at 20001000 in userspace [ 388.707217] binder: 7599:7602 transaction failed 29201/-12, size 0-0 line 3136 03:35:56 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="03000000000000000800000000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) [ 388.716280] binder: 7599:7602 IncRefs 0 refcount change on invalid ref 4 ret -22 [ 388.725487] binder: BINDER_SET_CONTEXT_MGR already set [ 388.730916] binder: 7599:7606 ioctl 40046207 0 returned -16 [ 388.736977] binder_alloc: 7599: binder_alloc_buf, no vma [ 388.736993] binder: 7599:7602 transaction failed 29189/-3, size 0-0 line 3136 [ 388.737190] binder: undelivered TRANSACTION_ERROR: 29189 [ 388.737247] binder: undelivered TRANSACTION_ERROR: 29201 [ 388.980939] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 389.034676] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 389.513351] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 389.528173] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 389.584844] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 389.599686] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 389.613156] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 389.628078] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 390.392142] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 390.427465] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 390.433583] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 390.441130] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:35:59 executing program 5: r0 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r0, 0x5380) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) getpeername$packet(r1, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000440)=0x14) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000480)={r2, 0x1, 0x6, @random="dce89590f697"}, 0x10) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000640)={r2, 0x1, 0x6, @dev={[], 0x12}}, 0x10) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000001c0)={'veth0_to_bond\x00', 0x400}) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f0000000540)={{{@in=@local, @in=@broadcast}}, {{@in6=@ipv4={[], [], @dev}}, 0x0, @in6=@local}}, &(0x7f0000000380)=0xe8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f00000003c0)) ioctl$UI_GET_SYSNAME(r0, 0x8040552c, &(0x7f0000000680)) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$KDGETKEYCODE(r0, 0x4b4c, &(0x7f0000000780)={0x4, 0x809}) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x200202, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in6=@local, @in=@multicast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@ipv4={[], [], @broadcast}}}, &(0x7f0000000040)=0xe8) setsockopt$packet_drop_memb(r4, 0x107, 0x2, &(0x7f0000000140)={r5, 0x1, 0xfffffe42}, 0xfffffffffffffd2d) 03:35:59 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r2, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) sendfile(r2, r2, &(0x7f0000317000), 0xff8) quotactl(0x0, &(0x7f0000000040)='./file0/file0\x00', 0x0, &(0x7f0000000100)) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_tcp(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x8000, &(0x7f00000001c0)={'trans=tcp,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@nodevmap='nodevmap'}, {@privport='privport'}, {@privport='privport'}, {@access_uid={'access', 0x3d, r3}}, {@aname={'aname', 0x3d, '/dev/binder#\x00'}}, {@access_user='access=user'}, {@version_L='version=9p2000.L'}]}}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:35:59 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd38"], 0x48) 03:35:59 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r0) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd'}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(0xffffffffffffffff, &(0x7f0000001000), 0x1000) write$FUSE_INIT(0xffffffffffffffff, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(0xffffffffffffffff, &(0x7f0000001000), 0x1000) [ 391.487905] device lo entered promiscuous mode [ 391.496720] device lo left promiscuous mode [ 391.593880] device lo entered promiscuous mode [ 391.600403] device lo left promiscuous mode [ 392.200964] IPVS: Creating netns size=2536 id=89 [ 392.227555] IPVS: Creating netns size=2536 id=90 [ 392.532641] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 392.550366] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 392.558855] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 392.577208] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 392.639749] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 392.659520] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 392.668062] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 392.687180] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 392.749109] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 392.773497] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 392.795381] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 392.802784] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 392.811923] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 392.823921] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 392.831824] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 392.839413] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 392.847283] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 392.856207] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 392.873984] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 392.881015] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 392.889320] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 392.900882] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 392.907936] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 392.915709] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 393.970921] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 394.025280] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 394.031411] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 394.038835] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 394.046708] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 394.100881] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 394.107542] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 394.117429] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:36:02 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(0xffffffffffffffff) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:02 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x3bafd980196e5e4a, 0x0) getpeername$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev}, &(0x7f0000000080)=0x1c) setsockopt$inet_tcp_TLS_RX(r1, 0x6, 0x2, &(0x7f0000000100), 0x4) 03:36:02 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:02 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$usbmon(&(0x7f0000000200)='/dev/usbmon#\x00', 0x4, 0x40002) ioctl$TIOCCONS(r1, 0x541d) r2 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r4 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r5) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r2) 03:36:02 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={"6c6f00000000000000000000000200", 0x80000}) 03:36:02 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r2, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) sendfile(r2, r2, &(0x7f0000317000), 0xff8) quotactl(0x0, &(0x7f0000000040)='./file0/file0\x00', 0x0, &(0x7f0000000100)) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_tcp(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x8000, &(0x7f00000001c0)={'trans=tcp,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@nodevmap='nodevmap'}, {@privport='privport'}, {@privport='privport'}, {@access_uid={'access', 0x3d, r3}}, {@aname={'aname', 0x3d, '/dev/binder#\x00'}}, {@access_user='access=user'}, {@version_L='version=9p2000.L'}]}}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:02 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd38"], 0x48) [ 394.525107] device lo entered promiscuous mode 03:36:02 executing program 0: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) [ 394.550540] binder_alloc: 8747: binder_alloc_buf failed to map page at 20001000 in userspace [ 394.551300] device lo entered promiscuous mode [ 394.559254] device lo left promiscuous mode [ 394.565903] device lo left promiscuous mode [ 394.631923] binder: 8747:8751 transaction failed 29201/-12, size 0-0 line 3136 03:36:02 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='smaps_rollup\x00') getpeername$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000080)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000140)={{{@in=@remote, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @broadcast}}, 0x0, @in=@remote}}, &(0x7f00000000c0)=0xe8) setsockopt$inet6_IPV6_IPSEC_POLICY(r2, 0x29, 0x22, &(0x7f0000000480)={{{@in=@dev={0xac, 0x14, 0x14, 0xe}, @in=@local, 0x4e20, 0x0, 0x4e23, 0x3, 0x2, 0x80, 0x20, 0x0, r3, r4}, {0xe4ca, 0x401, 0x3, 0x4, 0xfffffffffffffc70, 0x3ff, 0x7, 0x8}, {0x1, 0x7ff, 0x0, 0x8ad0}, 0x10000}, {{@in=@broadcast, 0x4d6, 0x32}, 0xa, @in=@broadcast, 0x0, 0x3, 0x1, 0x36, 0x7ff, 0x3, 0xffffffffffffffff}}, 0xe8) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 394.659195] binder_alloc: binder_alloc_mmap_handler: 8747 20001000-20004000 already mapped failed -16 [ 394.671118] binder: BINDER_SET_CONTEXT_MGR already set [ 394.676619] binder: 8747:8765 ioctl 40046207 0 returned -16 [ 394.683024] binder: undelivered TRANSACTION_ERROR: 29201 03:36:02 executing program 7: openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000ffff00000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 394.717683] binder_alloc: 8768: binder_alloc_buf failed to map page at 20001000 in userspace [ 394.726365] binder: 8768:8770 transaction failed 29201/-12, size 0-0 line 3136 [ 394.735585] binder_alloc: binder_alloc_mmap_handler: 8768 20001000-20004000 already mapped failed -16 [ 394.745909] binder: BINDER_SET_CONTEXT_MGR already set [ 394.751203] binder: 8768:8771 ioctl 40046207 0 returned -16 [ 394.758543] binder: undelivered TRANSACTION_ERROR: 29201 03:36:02 executing program 1: r0 = openat(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x40000, 0x20) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000180)={0x3, &(0x7f0000000080)=[{}, {}, {}]}) ioctl$KDGKBLED(r0, 0x4b64, &(0x7f0000000040)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$fiemap(r1, 0xc020660b, &(0x7f00000001c0)={0x5, 0x1400, 0x4, 0x9, 0x2, [{0x200, 0x1ff, 0x4, 0x0, 0x0, 0x2}, {0x234e, 0x80000001, 0x8, 0x0, 0x0, 0x8}]}) lstat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)) fstat(r1, &(0x7f0000000100)) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={"00000000e8ff000000ab0000007800", 0x1400}) [ 394.779100] device lo entered promiscuous mode [ 394.787383] binder_alloc: 8774: binder_alloc_buf size 16776960 failed, no address space [ 394.796073] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 394.804942] binder: 8774:8775 transaction failed 29201/-28, size 16776960-0 line 3136 [ 394.805322] device lo left promiscuous mode [ 394.821717] binder: BINDER_SET_CONTEXT_MGR already set [ 394.827052] binder: 8774:8775 ioctl 40046207 0 returned -16 [ 394.834684] device lo entered promiscuous mode [ 394.836715] device lo left promiscuous mode [ 394.845291] binder_alloc: 8774: binder_alloc_buf, no vma [ 394.845308] binder: 8774:8776 transaction failed 29189/-3, size 16776960-0 line 3136 [ 394.845555] binder: undelivered TRANSACTION_ERROR: 29189 03:36:02 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0xf) getsockname(0xffffffffffffff9c, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, &(0x7f00000000c0)=0x80) setsockopt$packet_fanout_data(r2, 0x107, 0x16, &(0x7f0000000180)={0x3, &(0x7f0000000140)=[{0xfffffffffffff49e, 0x10001, 0x10001, 0xffff}, {0x9142, 0xa1, 0x5000000000, 0x5}, {0x5, 0x2, 0x2, 0x7}]}, 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 394.845614] binder: undelivered TRANSACTION_ERROR: 29201 [ 394.857281] IPVS: Creating netns size=2536 id=91 [ 394.914240] binder_alloc: 8785: binder_alloc_buf failed to map page at 20001000 in userspace 03:36:02 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x40006, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) socket$inet(0x2, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000011ff0)={0x2, 0x0, @multicast2}, 0x10) getsockopt$IP_VS_SO_GET_SERVICES(0xffffffffffffffff, 0x0, 0x482, &(0x7f00000008c0)=""/193, &(0x7f0000000280)=0xffffffffffffff05) fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000000000)="766574683100000000ffffffffffef00", 0x10) r1 = socket$inet6(0xa, 0x3, 0x1) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f00000001c0)={@remote, 0x800, 0x0, 0xff, 0xffffffffffffffff}, 0x91) socket(0x0, 0x0, 0x0) ioctl$EVIOCGBITKEY(0xffffffffffffffff, 0x80404521, &(0x7f00000002c0)=""/112) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000240)) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:02 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_threshold\x00', 0x2, 0x0) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) [ 394.925476] binder: 8785:8787 transaction failed 29201/-12, size 0-0 line 3136 03:36:02 executing program 0: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:02 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) lstat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000280)) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) r5 = pkey_alloc(0x0, 0x2) pkey_free(r5) [ 394.968648] device lo entered promiscuous mode [ 394.980836] device lo entered promiscuous mode [ 394.990915] binder_alloc: binder_alloc_mmap_handler: 8785 20001000-20004000 already mapped failed -16 [ 395.001811] device lo left promiscuous mode [ 395.021119] device lo entered promiscuous mode [ 395.034900] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 395.037384] device lo left promiscuous mode [ 395.043900] device lo left promiscuous mode [ 395.065665] binder: BINDER_SET_CONTEXT_MGR already set [ 395.070945] binder: 8785:8800 ioctl 40046207 0 returned -16 [ 395.084262] binder: undelivered TRANSACTION_ERROR: 29201 [ 395.196901] device lo entered promiscuous mode [ 395.206750] Can not set IPV6_FL_F_REFLECT if flowlabel_consistency sysctl is enable [ 395.221229] device lo left promiscuous mode 03:36:03 executing program 4: r0 = dup(0xffffffffffffff9c) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000000000)=@req={0x228, 0x8, 0x20, 0x5}, 0x10) madvise(&(0x7f000004f000/0x4000)=nil, 0x4000, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0)='IPVS\x00') sendmsg$IPVS_CMD_NEW_DAEMON(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x38, r2, 0x420, 0x70bd2c, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DEST={0x24, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x100000001}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x4}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x7}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x8}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x4) ioctl(r1, 0x8912, &(0x7f0000000080)="0a5cc80700315f85715070") mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x0, 0x8c4b815a5465c2b2, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000836000/0x400000)=nil, 0x400000, 0x3) write$UHID_DESTROY(r0, &(0x7f00000001c0), 0x4) 03:36:03 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="006340400000001792ff14a6885ef3a37163cb36052d81000000000000000000000000000000000000000000000000000000000000003a000000000000000000000000000cc003c6d369d263fc68087759d904a60529a349bc28a2068cf8b784c5511e48d23c6a8c47314c7f1c25db5662e18795d1b67d8e3ae169d4dfbfcfc04965649f45afac6204da1936a46617ab34a62463453f6206483c351a66628eb4620ef74ca2bb050f6b59dd5827b4050a02fcd32e4d2fd5afc21748554acb09c60820ca558fb376deac1e7a06bf277de79ec9a6337353c78d7e97bef8eafd0e2071b2f5cc52d960b514a64f6c25c77b4bf65b959ff1429e6a4a00b24ae4b5f202db9857ef0d05ebdbe5c3ab751a6ad6165e0d6867daf882ee3d9c072b87a748e20aec31e4238943b069e72949375144850902068fd8c114d738168c9150b3b4eca540599ac0f3510f64689323f9373c8ac2f2ad90ab54", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:03 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) pipe2(&(0x7f00000000c0)={0xffffffffffffffff}, 0x80000) r2 = syz_genetlink_get_family_id$fou(&(0x7f0000000140)='fou\x00') sendmsg$FOU_CMD_DEL(r1, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x28180000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x48, r2, 0x232, 0x70bd2b, 0x25dfdbfe, {}, [@FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_TYPE={0x8, 0x4, 0x3}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_IPPROTO={0x8, 0x3, 0x3b}, @FOU_ATTR_PORT={0x8, 0x1, 0x4e21}, @FOU_ATTR_TYPE={0x8, 0x4, 0x3}, @FOU_ATTR_REMCSUM_NOPARTIAL={0x4}, @FOU_ATTR_AF={0x8}]}, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x4840, 0x0) openat$cgroup_int(r3, &(0x7f0000000440)="6370752e9bc923624fa8ab943b2fd31e572fb87f20c6eb6c3b4a7d4071a42c49949150ef9b30b1098a23c8f9add1a4496942e5c09262660ca2bcfd643a3b60b8efd56d9705656accc9027a82a9188959aa87c73a815f3ed89a75de6a895e65c9b867f73a6eefc77e2a", 0x2, 0x0) ioctl$EVIOCGEFFECTS(r3, 0x80044584, &(0x7f00000002c0)=""/205) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'lo\x00@\x00', 0x102}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:03 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x800000000000001, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:03 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd38"], 0x48) [ 395.411943] device lo entered promiscuous mode [ 395.428959] binder: 8845:8853 got transaction to invalid handle [ 395.428968] binder: 8845:8853 transaction failed 29201/-22, size 0-0 line 3013 [ 395.433316] binder_alloc: binder_alloc_mmap_handler: 8845 20001000-20004000 already mapped failed -16 [ 395.433413] binder: BINDER_SET_CONTEXT_MGR already set [ 395.433420] binder: 8845:8856 ioctl 40046207 0 returned -16 [ 395.433735] binder: undelivered TRANSACTION_ERROR: 29201 [ 395.476899] device lo entered promiscuous mode [ 395.484907] device lo left promiscuous mode [ 395.561797] device lo left promiscuous mode [ 395.571478] device lo entered promiscuous mode [ 395.577392] device lo left promiscuous mode [ 395.623915] device lo entered promiscuous mode [ 395.628721] device lo left promiscuous mode [ 395.725629] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 395.740117] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 395.800481] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 395.814478] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 395.876718] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 395.890947] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 395.905018] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 395.920816] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 395.927810] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 395.935678] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 396.608760] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 396.642356] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 396.648806] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 396.656280] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:36:04 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[{0x3, 0x1}], 0x1) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) ioctl$sock_inet_SIOCGIFDSTADDR(r0, 0x8917, &(0x7f0000000040)={'bridge_slave_0\x00', {0x2, 0x4e23, @broadcast}}) 03:36:04 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r2, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) sendfile(r2, r2, &(0x7f0000317000), 0xff8) quotactl(0x0, &(0x7f0000000040)='./file0/file0\x00', 0x0, &(0x7f0000000100)) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_tcp(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x8000, &(0x7f00000001c0)={'trans=tcp,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@nodevmap='nodevmap'}, {@privport='privport'}, {@privport='privport'}, {@access_uid={'access', 0x3d, r3}}, {@aname={'aname', 0x3d, '/dev/binder#\x00'}}, {@access_user='access=user'}, {@version_L='version=9p2000.L'}]}}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:04 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) ioctl$TUNSETLINK(r2, 0x400454cd, 0x334) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000200)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="03000024e7b1218ad1098e0c900099ab0000009d00376153ec689b16ed00000000235eec26ace93314294927ba6e59cfb8fe87268a1db1d8757779e80a51245204245121112cc6c39ffad4d19c8cff616d998f4ae913bf039c091429b19ad9cd7168ea082757e77d8f3180cae5e97998682c609b8c781bac2276d098776cbb43bb15ccd2df5d81fca3190e185b6c4603c8735629f04ce0167246212cd2d5528cb85e14dcf9923fdc2eb4525629c6ea86c9afdafbe1be583685aa8e00080000c8e0fece0000000000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:36:04 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x400800) write$P9_RLINK(r1, &(0x7f0000000040)={0x7, 0x47, 0x1}, 0x7) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000080)={'lo\x00', 0x2}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:04 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0xff80000000000003) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x20011, r1, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000080)=0xc) getpgrp(r2) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/checkreqprot\x00', 0x400, 0x0) ioctl$PIO_FONTX(r3, 0x4b6c, &(0x7f0000000140)="38e760142e8895c4cfa615bb5e842b11d9ec355065313a8417b6c847abc7531fee61a21bd0bc96206dec162586a3d57489e8ffa503afd00d741971629de92034380c37fa5466e46001934db9bfb786d109e31e5d827594cc4dc58cf1adcadf") ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:04 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be"], 0x6c) 03:36:04 executing program 4: mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x0, 0x32, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000200)={0xffffffffffffffff}) setsockopt$inet_buf(r0, 0x0, 0x2e, &(0x7f0000000240)="fca0ed6692b66205de2ba08107c836d599914f406e86ed90b5671b4b7ab1a5f47011a656d543ebbbc04f877396905d22c6ce574abb7045d00feacd6ee180b49c17affcad49d1fff8ef8a97bed127f4df9ed897d3fdfefc58eb2195291b192885b42a5f4364cb54f0c6c043e15070aaf4632909aa5e04a7e6b749e19baf4e7d7f2f74b778dca4f94a45fed1493a58c6e71bc116952782d853ec899e0e14ab2f1f30bf77574437bbe14745955e7894acf2dacbf0340e9d3fa9a749842d08d4053665c9b991b7682732cc8e9be44cda53fc09a80e9263fe74d3cb895e31ff672fb461abb3bea4595ff2", 0xe8) unshare(0x503) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/mls\x00', 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000440)="2f65786500e1ffffff0409004bddd9de91be10eebf000ee9a90f798058439ed554fa07424adee901d2da75af1f02acc7edbcd7a071fbbc7864c3cf7318e89c6e97ca49e2523f8d54c646dd47000000000000000000000082c8ed780fc8de13aac81a5393802cac9b30bd34f4b1aa91950e3321095ed1dc0609f379617d65d54e4900f041cf05b8b29c725e548eba7414e6686d0e4d0e354ffbecf9b6cb56df37daad793393cdf96d60c334d7dee99d58bb98ec8fbae88509abe32fd44239abb4ccf659f55c76c288ae1d12b8aef689f19c39d9cdd8a249969185b3f229a48ef301365dc6762a1967eb3241f49796f3f6ceb28fd1833071281f0d81aee58fc8a61050486d5641c3dfc84c25baa2b3712cb8251267e70159894f6dd8f293e8cd44ea35ca1c52f1c165b6391d779405fabfaf835c2928c61282a10cfee523c694139d9b158c8ac9c2068deae9563a8661cef5dfb87149694d3b000cd5cc727f52139996dd2f575b0af9cc013f275d3651") pread64(r1, &(0x7f00000005c0)=""/67, 0x43, 0x0) fsetxattr(r2, &(0x7f0000000000)=@known='user.syz\x00', &(0x7f00000000c0)='\x00', 0xfe9, 0x0) getpeername(r1, &(0x7f0000000100)=@sco, &(0x7f0000000180)=0x80) r3 = mq_open(&(0x7f0000000000)='-$\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000664fc0)={0x0, 0x5, 0x71a}) clock_adjtime(0x3, &(0x7f0000000340)={0x1, 0x800, 0x0, 0x80, 0x3da, 0x100000001, 0x7fff, 0x3, 0x101, 0x1, 0x5b09ba6f, 0x81, 0x1f, 0x10000, 0x54f, 0x1, 0x2, 0x0, 0xffffffff, 0x0, 0x7, 0x1f, 0x8, 0x100000000, 0x8000, 0x8}) write$P9_RFSYNC(r1, &(0x7f00000001c0)={0x7, 0x33, 0x2}, 0x7) mq_timedsend(r3, &(0x7f0000000040), 0x174, 0x0, &(0x7f0000000040)) mq_timedreceive(r3, &(0x7f00000011c0)=""/4096, 0x93b1643f93b0cb3a, 0x0, &(0x7f0000000080)) vmsplice(r3, &(0x7f00000007c0)=[{&(0x7f00000006c0)="469ff3b7a9f89f27b638af963bf69fdd71a3d4180ebd4dbca34326a8cd9d16acb9a52c7e86b75dfa8a3b042dfca9da8187b40f3847d906a3a69122f0e6b444e1ff312c94d9b7fa44a274ff68f226e1d94d5f9d4f8464c683983da7cd89cd624ef7100adb1670cda1ccb3558ae85285e508a76d64a24fd36eeb57b5423b4e351986591609af33568c2dc85ccb4329f9c95a8264130a7900e6d39071d458754381198624bfe0af17ff4f47a494a1a300da337b54d3a09ce36dc16da35cd0ae86e7d5f97a4e9a01", 0xc6}], 0x1, 0x4) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r0, 0x6, 0x1d, &(0x7f0000000640), &(0x7f0000000680)=0x14) ioctl$SCSI_IOCTL_START_UNIT(r2, 0x5) [ 396.892064] binder: 9207:9208 ioctl c0306201 20000440 returned -14 [ 396.923320] device lo entered promiscuous mode [ 396.929641] binder: 9214:9219 transaction failed 29189/-22, size 0-0 line 3013 03:36:04 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r2, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) sendfile(r2, r2, &(0x7f0000317000), 0xff8) quotactl(0x0, &(0x7f0000000040)='./file0/file0\x00', 0x0, &(0x7f0000000100)) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_tcp(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x8000, &(0x7f00000001c0)={'trans=tcp,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@nodevmap='nodevmap'}, {@privport='privport'}, {@privport='privport'}, {@access_uid={'access', 0x3d, r3}}, {@aname={'aname', 0x3d, '/dev/binder#\x00'}}, {@access_user='access=user'}, {@version_L='version=9p2000.L'}]}}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 396.939726] binder_alloc: binder_alloc_mmap_handler: 9214 20ffa000-20ffe000 already mapped failed -16 [ 396.949489] binder: BINDER_SET_CONTEXT_MGR already set [ 396.955014] binder: 9214:9223 ioctl 40046207 0 returned -16 03:36:04 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r2, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) sendfile(r2, r2, &(0x7f0000317000), 0xff8) quotactl(0x0, &(0x7f0000000040)='./file0/file0\x00', 0x0, &(0x7f0000000100)) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_tcp(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x8000, &(0x7f00000001c0)={'trans=tcp,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@nodevmap='nodevmap'}, {@privport='privport'}, {@privport='privport'}, {@access_uid={'access', 0x3d, r3}}, {@aname={'aname', 0x3d, '/dev/binder#\x00'}}, {@access_user='access=user'}, {@version_L='version=9p2000.L'}]}}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 396.955017] binder: BINDER_SET_CONTEXT_MGR already set [ 396.955028] binder: 9215:9222 ioctl 40046207 0 returned -16 [ 396.955873] binder: 9215:9222 ioctl c0306201 20000440 returned -14 [ 396.975508] device lo entered promiscuous mode [ 396.979532] device lo left promiscuous mode [ 397.000706] binder: 9226:9229 ioctl c0306201 20000440 returned -14 [ 397.004274] binder: 9214:9219 transaction failed 29189/-22, size 0-0 line 3013 [ 397.004499] binder: undelivered TRANSACTION_ERROR: 29189 [ 397.004567] binder: undelivered TRANSACTION_ERROR: 29189 [ 397.047411] binder: 9232:9235 ioctl c0306201 20000440 returned -14 [ 397.180887] device lo left promiscuous mode [ 397.196414] device lo entered promiscuous mode [ 397.202112] device lo entered promiscuous mode [ 397.208509] device lo left promiscuous mode [ 397.252751] device lo left promiscuous mode [ 397.272409] IPVS: Creating netns size=2536 id=92 [ 397.313561] IPVS: Creating netns size=2536 id=93 [ 397.626327] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 397.644519] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 397.677620] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 397.697294] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 397.747437] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 397.774620] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 397.806145] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 397.825375] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 397.874013] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 397.892327] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 397.911208] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 397.929572] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 397.937920] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 397.957701] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 397.977188] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 397.996484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 399.045796] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 399.077830] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 399.099758] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 399.105943] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 399.112596] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 399.143352] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 399.149796] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 399.157495] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:36:08 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) r1 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/status\x00', 0x0, 0x0) ioctl$ASHMEM_SET_PROT_MASK(r1, 0x40087705, &(0x7f0000000080)={0x80000000, 0x401}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/checkreqprot\x00', 0x0, 0x0) ioctl$ASHMEM_PURGE_ALL_CACHES(r2, 0x770a, 0x0) ioctl$ASHMEM_SET_SIZE(r2, 0x40087703, 0x9) fcntl$setsig(r0, 0xa, 0x32) pwrite64(r0, &(0x7f00000001c0)="69b9a8d9b5b32e95a7ecb8cd4696e276e7d5447bfad8152386d62f60e040568a128fa4eb97c67ef25579712fbc77df8f4d5127541b114d04e5d52bc09d2a34260966d2dfaea11ced36a5cdb70f807ad252d59ec76dfad41a402ba9efe64fa4fdbe1282b0547d068b888d75d9667c60194743289a0b63ca5b97770d9e3fa043da1c37759e9484e05dba77af29f2a96cbe323bb21a53f4646de5d34369eeca6918", 0xa0, 0x0) 03:36:08 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) quotactl(0x0, &(0x7f0000000040)='./file0/file0\x00', 0x0, &(0x7f0000000100)) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$9p_tcp(&(0x7f0000000000)='127.0.0.1\x00', &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='9p\x00', 0x8000, &(0x7f00000001c0)={'trans=tcp,', {'port', 0x3d, 0x4e21}, 0x2c, {[{@nodevmap='nodevmap'}, {@privport='privport'}, {@privport='privport'}, {@access_uid={'access', 0x3d, r2}}, {@aname={'aname', 0x3d, '/dev/binder#\x00'}}, {@access_user='access=user'}, {@version_L='version=9p2000.L'}]}}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:08 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) r2 = mmap$binder(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x2000000, 0x10, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={r2}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:08 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) openat$ipvs(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/sys/net/ipv4/vs/schedule_icmp\x00', 0x2, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') openat$cgroup_subtree(r4, &(0x7f0000000280)='cgroup.subtree_control\x00', 0x2, 0x0) r7 = fcntl$getown(r5, 0x9) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r7, 0xfff, &(0x7f0000000200)=""/24) ioctl$LOOP_SET_FD(r0, 0x4c00, r6) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:36:08 executing program 5: r0 = syz_open_dev$rtc(&(0x7f0000000000)='/dev/rtc#\x00', 0x10000, 0x400) ioctl$RTC_UIE_OFF(r0, 0x7004) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000080)='/dev/loop#\x00', 0x80000000000000, 0x801) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"00000000e500", 0x800002100}) 03:36:08 executing program 0: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:08 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be"], 0x6c) 03:36:08 executing program 4: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0) getsockopt$EBT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000180)={'broute\x00'}, &(0x7f0000000200)=0x78) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000080)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz0\x00', 0x1ff) fallocate(r1, 0x1, 0x0, 0x10000101) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getpgid(0xffffffffffffffff) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000240)={0x2, 'ip6gre0\x00'}, 0x18) ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, &(0x7f0000000180)={{0x2, 0x4e24, @broadcast}, {0x1, @random="59a310eebccc"}, 0x0, {0x2, 0x4e21, @broadcast}, 'team0\x00'}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_opts(r0, 0x0, 0x9, &(0x7f0000000540)=""/4096, &(0x7f0000000280)=0x1000) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) r3 = memfd_create(&(0x7f0000000480)="00eb0c432d0174df5f00", 0x3) pwritev(r3, &(0x7f0000000340)=[{&(0x7f0000000040)}], 0x1, 0x81806) ioctl$UI_END_FF_UPLOAD(r3, 0x406855c9, &(0x7f0000000380)={0x10, 0x8001, {0x57, 0x0, 0x6, {0x0, 0xfc}, {0x2, 0x2}, @ramp={0x9, 0x2, {0x3, 0x6, 0x5, 0x7}}}, {0x53, 0x0, 0x5, {0x3, 0x6d}, {0x100, 0x1}, @period={0x0, 0x80000001, 0x100, 0xfffffffffffffffc, 0x0, {0x3, 0x7, 0x3, 0xfffffffffffffe01}, 0x1, &(0x7f00000002c0)=[0x8001]}}}) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) sendfile(r2, r2, &(0x7f0000000000), 0x2000005) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f00000000c0)={0x3, 0x1, 0xffffffffffffffff, 0x3, 0x9}) creat(&(0x7f0000000040)='./file0\x00', 0x0) 03:36:08 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) quotactl(0x0, &(0x7f0000000040)='./file0/file0\x00', 0x0, &(0x7f0000000100)) lstat(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:08 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000080)={0x0, @multicast2, @loopback}, &(0x7f0000000100)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000140)={'team0\x00', r1}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) r2 = socket$inet6(0xa, 0x3, 0x9) getsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, &(0x7f0000000000)={@mcast1, 0x5, 0x0, 0x2, 0x2, 0x2eb0, 0x6, 0x87}, &(0x7f0000000040)=0x20) [ 400.345236] binder_alloc: 9995: binder_alloc_buf failed to map page at 20001000 in userspace [ 400.350856] device lo entered promiscuous mode [ 400.353884] binder: 9993:9996 ioctl c0306201 20000440 returned -14 [ 400.360567] device lo left promiscuous mode [ 400.369064] device lo entered promiscuous mode 03:36:08 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) quotactl(0x0, &(0x7f0000000040)='./file0/file0\x00', 0x0, &(0x7f0000000100)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:08 executing program 4: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0) getsockopt$EBT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000180)={'broute\x00'}, &(0x7f0000000200)=0x78) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000080)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz0\x00', 0x1ff) fallocate(r1, 0x1, 0x0, 0x10000101) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getpgid(0xffffffffffffffff) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000240)={0x2, 'ip6gre0\x00'}, 0x18) ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, &(0x7f0000000180)={{0x2, 0x4e24, @broadcast}, {0x1, @random="59a310eebccc"}, 0x0, {0x2, 0x4e21, @broadcast}, 'team0\x00'}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_opts(r0, 0x0, 0x9, &(0x7f0000000540)=""/4096, &(0x7f0000000280)=0x1000) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) r3 = memfd_create(&(0x7f0000000480)="00eb0c432d0174df5f00", 0x3) pwritev(r3, &(0x7f0000000340)=[{&(0x7f0000000040)}], 0x1, 0x81806) ioctl$UI_END_FF_UPLOAD(r3, 0x406855c9, &(0x7f0000000380)={0x10, 0x8001, {0x57, 0x0, 0x6, {0x0, 0xfc}, {0x2, 0x2}, @ramp={0x9, 0x2, {0x3, 0x6, 0x5, 0x7}}}, {0x53, 0x0, 0x5, {0x3, 0x6d}, {0x100, 0x1}, @period={0x0, 0x80000001, 0x100, 0xfffffffffffffffc, 0x0, {0x3, 0x7, 0x3, 0xfffffffffffffe01}, 0x1, &(0x7f00000002c0)=[0x8001]}}}) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) sendfile(r2, r2, &(0x7f0000000000), 0x2000005) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f00000000c0)={0x3, 0x1, 0xffffffffffffffff, 0x3, 0x9}) creat(&(0x7f0000000040)='./file0\x00', 0x0) [ 400.374767] device lo entered promiscuous mode 03:36:08 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) 03:36:08 executing program 5: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/checkreqprot\x00', 0x800, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r2, 0x8004e500, &(0x7f0000000100)=r0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) r3 = getpgrp(0xffffffffffffffff) getpgrp(r3) capset(&(0x7f0000000000)={0x399f1336, r3}, &(0x7f0000000040)={0x8, 0x81, 0x101, 0x8, 0x0, 0x4}) 03:36:08 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 400.383632] device lo left promiscuous mode [ 400.467758] binder: 10010:10021 ioctl c0306201 20000440 returned -14 [ 400.469874] device lo entered promiscuous mode 03:36:08 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:08 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) socketpair$inet_udplite(0x2, 0x2, 0x88, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) ioctl$sock_inet_SIOCGIFNETMASK(r1, 0x891b, &(0x7f0000000040)={'veth0_to_team\x00', {0x2, 0x4e20, @broadcast}}) 03:36:08 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 400.518702] device lo left promiscuous mode [ 400.521320] device lo entered promiscuous mode [ 400.530295] device lo left promiscuous mode [ 400.538637] binder: 10032:10036 ioctl c0306201 20000440 returned -14 [ 400.589914] device lo entered promiscuous mode [ 400.594592] device lo left promiscuous mode [ 400.605300] device lo entered promiscuous mode [ 400.612472] device lo left promiscuous mode [ 400.629564] binder: 10052:10056 ioctl c0306201 20000440 returned -14 [ 400.681770] device lo entered promiscuous mode [ 400.684656] binder: 10059:10063 ioctl c0306201 20000440 returned -14 [ 400.692582] device lo left promiscuous mode [ 400.694606] device lo entered promiscuous mode [ 400.713531] device lo left promiscuous mode [ 400.790306] binder: 9995:9997 transaction failed 29201/-12, size 4096-0 line 3136 [ 400.808087] binder_alloc: binder_alloc_mmap_handler: 9995 20001000-20004000 already mapped failed -16 [ 400.817866] binder: BINDER_SET_CONTEXT_MGR already set 03:36:08 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c\x00D\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:08 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) r1 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) connect$unix(r1, &(0x7f0000000040)=@file={0x1, './file0\x00'}, 0x6e) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:08 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = dup3(r3, r0, 0x80000) mq_getsetattr(r4, &(0x7f0000000200)={0x1f, 0xc97, 0x92, 0x386, 0x80000000, 0x5, 0x3d05, 0x80000000}, &(0x7f0000000280)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r5) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:36:08 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 400.823265] binder: 9995:10076 ioctl 40046207 0 returned -16 [ 400.831706] binder: undelivered TRANSACTION_ERROR: 29201 [ 400.852070] device lo left promiscuous mode [ 400.865903] binder: 10082:10084 ioctl c0306201 20000440 returned -14 [ 400.871878] binder: 10083:10086 unknown command 1140876032 [ 400.871886] binder: 10083:10086 ioctl c0306201 20000440 returned -22 [ 400.872678] binder_alloc: binder_alloc_mmap_handler: 10083 20001000-20004000 already mapped failed -16 [ 400.879069] binder: BINDER_SET_CONTEXT_MGR already set [ 400.879078] binder: 10083:10087 ioctl 40046207 0 returned -16 [ 400.987130] device lo entered promiscuous mode [ 401.000102] device lo left promiscuous mode 03:36:08 executing program 4: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0) getsockopt$EBT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000180)={'broute\x00'}, &(0x7f0000000200)=0x78) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000080)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz0\x00', 0x1ff) fallocate(r1, 0x1, 0x0, 0x10000101) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getpgid(0xffffffffffffffff) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000240)={0x2, 'ip6gre0\x00'}, 0x18) ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, &(0x7f0000000180)={{0x2, 0x4e24, @broadcast}, {0x1, @random="59a310eebccc"}, 0x0, {0x2, 0x4e21, @broadcast}, 'team0\x00'}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_opts(r0, 0x0, 0x9, &(0x7f0000000540)=""/4096, &(0x7f0000000280)=0x1000) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) r3 = memfd_create(&(0x7f0000000480)="00eb0c432d0174df5f00", 0x3) pwritev(r3, &(0x7f0000000340)=[{&(0x7f0000000040)}], 0x1, 0x81806) ioctl$UI_END_FF_UPLOAD(r3, 0x406855c9, &(0x7f0000000380)={0x10, 0x8001, {0x57, 0x0, 0x6, {0x0, 0xfc}, {0x2, 0x2}, @ramp={0x9, 0x2, {0x3, 0x6, 0x5, 0x7}}}, {0x53, 0x0, 0x5, {0x3, 0x6d}, {0x100, 0x1}, @period={0x0, 0x80000001, 0x100, 0xfffffffffffffffc, 0x0, {0x3, 0x7, 0x3, 0xfffffffffffffe01}, 0x1, &(0x7f00000002c0)=[0x8001]}}}) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) sendfile(r2, r2, &(0x7f0000000000), 0x2000005) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f00000000c0)={0x3, 0x1, 0xffffffffffffffff, 0x3, 0x9}) creat(&(0x7f0000000040)='./file0\x00', 0x0) 03:36:08 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be"], 0x6c) 03:36:08 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) write$selinux_user(r1, &(0x7f0000000040)={'system_u:object_r:logrotate_var_lib_t:s0', 0x20, 'root\x00'}, 0x2e) 03:36:08 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x804) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = mmap$binder(&(0x7f0000000000/0x12000)=nil, 0x12000, 0x8, 0x80010, r0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0xf0, 0x0, &(0x7f0000000480)=[@dead_binder_done, @reply={0x40406301, {0x1, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x48, 0x40, &(0x7f0000000000)=[@fd={0x66642a85, 0x0, r0, 0x0, 0x3}, @flat={0x77682a85, 0x10a, r2, 0x3}, @fd={0x66642a85, 0x0, r0, 0x0, 0x1}], &(0x7f0000000080)=[0x0, 0x20, 0x18, 0x30, 0x20, 0x18, 0x28, 0x38]}}, @transaction_sg={0x40486311, {{0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x50, 0x20, &(0x7f0000000140)=[@fda={0x66646185, 0x0, 0x3, 0x1e}, @fd={0x66642a85, 0x0, r0, 0x0, 0x2}, @fd={0x66642a85, 0x0, r1}], &(0x7f00000000c0)=[0x78, 0x40, 0x48, 0x38]}, 0xffffffffffffffff}}, @decrefs, @transaction_sg={0x40486311, {{0x0, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x30, &(0x7f00000001c0), &(0x7f0000000200)=[0x78, 0x38, 0x20, 0x48, 0x20, 0x30]}, 0x1}}], 0x7f, 0x0, &(0x7f0000000240)="d304ecb9b4000376bd326cdb569e9024e108860d3dd55a636bca1a02b984baffb524d56eeb46590474f2e06972205c0e1d9fde8042ebd158a3a3bc9b96acbf70b553637c9d11568e184e54b3f4d7c5903cc1157f6863f7baac845e33972e25fce1a734421b6052ebb4c7407eb6961c284063254538991ef29e1841399516ad"}) 03:36:08 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:08 executing program 5: r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f00000002c0)=0x9) r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rfkill\x00', 0x40, 0x0) ioctl$EVIOCGNAME(r2, 0x80404506, &(0x7f0000000240)=""/102) r3 = socket$inet_tcp(0x2, 0x1, 0x0) getsockname(r3, &(0x7f0000000000)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff}}, &(0x7f0000000080)=0x80) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$BLKPBSZGET(r1, 0x127b, &(0x7f0000000140)) ioctl$sock_inet_SIOCSIFFLAGS(r4, 0x8914, &(0x7f0000000440)={'rose0\x00'}) sendto(r3, &(0x7f0000000300)="f1a2f0f68026af2f73483735a4bbdcecad64b19231e3c2bf39a7347757e7e0df0b3ab07f064075d22292a01ea49fa079924e098bc8136cacc218c3c9f1a32ad03f2a47439724be01976b71e2bf3a64d450e2595af5495f04f548e4f242390336480a8a71bbdd0d75f2257c930a4533a9048ca4cc20c54ead243c8deddfdad1b33b960f60f7f7b131a54da9", 0x8b, 0x800, &(0x7f00000003c0)=@in={0x2, 0x4e22, @local}, 0x80) 03:36:09 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:09 executing program 3: r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) getsockopt$inet6_tcp_int(r0, 0x6, 0x18, &(0x7f0000000280), &(0x7f00000002c0)=0x4) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) socketpair(0x1f, 0x80a, 0x81, &(0x7f0000000300)) sendmsg$nl_route(r6, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRESDEC=r5], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r7 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r1, 0x4c00, r7) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2) ioctl$sock_proto_private(r4, 0x89ea, &(0x7f0000000180)="de70fdfc85d0ab") [ 401.157465] binder: 10097:10100 transaction failed 29189/-22, size 0-0 line 3013 [ 401.166855] device lo entered promiscuous mode [ 401.171713] device lo entered promiscuous mode [ 401.173862] device lo left promiscuous mode 03:36:09 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) r1 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x30, &(0x7f00000001c0)={0x8, {{0xa, 0x4e24, 0x6, @ipv4={[], [], @dev={0xac, 0x14, 0x14, 0x10}}, 0x3f}}, 0x0, 0x6, [{{0xa, 0x4e24, 0x5, @local, 0x5}}, {{0xa, 0x4e26, 0x5, @loopback, 0xaa1}}, {{0xa, 0x4e20, 0x101, @remote, 0x19b97503}}, {{0xa, 0x4e22, 0x35, @loopback, 0x705b}}, {{0xa, 0x4e23, 0x6, @loopback, 0x6}}, {{0xa, 0x4e20, 0x5, @dev={0xfe, 0x80, [], 0x1a}, 0x7}}]}, 0x390) write$P9_RUNLINKAT(r1, &(0x7f0000000080)={0x7, 0x4d, 0x2}, 0x7) r2 = geteuid() setsockopt$ARPT_SO_SET_REPLACE(r0, 0x0, 0x60, &(0x7f0000000580)={'filter\x00', 0x7, 0x4, 0x4a8, 0x140, 0x0, 0x0, 0x3c0, 0x3c0, 0x3c0, 0x4, &(0x7f0000000040), {[{{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@dev={[], 0x11}, @empty, @local, @loopback, 0xf, 0x1}}}, {{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xf}, @mac=@local, @multicast2, @rand_addr=0x3, 0xf, 0xffffffff}}}, {{@arp={@empty, @local, 0xff, 0xff, @mac=@random="d7ba3427234f", {[0x0, 0xd3e608ebc0ad6aa8, 0xff, 0x0, 0x0, 0xff]}, @mac=@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}, {[0x0, 0xff, 0xff]}, 0x7fffffff, 0x3, 0x2, 0xfffffffffffffff8, 0xffff, 0x2, 'bond_slave_1\x00', 'dummy0\x00', {0xff}, {0xff}, 0x0, 0x14}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@random="8a5a9375eaa6", @mac=@local, @empty, @loopback, 0x2, 0xffffffff}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4f8) ioctl$TUNSETOWNER(r1, 0x400454cc, r2) ioctl$KDSETLED(r1, 0x4b32, 0x6) [ 401.176163] binder: 10096:10104 ioctl c0306201 20000440 returned -14 [ 401.181754] device lo entered promiscuous mode [ 401.191574] device lo left promiscuous mode [ 401.218706] binder: 10097:10108 BC_DEAD_BINDER_DONE 0000000000000000 not found [ 401.218716] binder: 10097:10108 got reply transaction with no transaction stack [ 401.218725] binder: 10097:10108 transaction failed 29201/-71, size 72-64 line 2921 [ 401.264457] device lo entered promiscuous mode [ 401.266174] binder: 10113:10119 transaction failed 29189/-22, size 0-0 line 3013 [ 401.266373] binder: undelivered TRANSACTION_ERROR: 29189 [ 401.269204] device lo left promiscuous mode [ 401.283965] device lo entered promiscuous mode [ 401.303836] device lo left promiscuous mode [ 401.376910] binder_alloc: binder_alloc_mmap_handler: 10097 20001000-20004000 already mapped failed -16 [ 401.389907] binder: BINDER_SET_CONTEXT_MGR already set [ 401.395476] binder: 10097:10108 ioctl 40046207 0 returned -16 [ 401.401750] binder: 10097:10100 transaction failed 29189/-22, size 0-0 line 3013 [ 401.404860] binder: undelivered TRANSACTION_ERROR: 29189 [ 401.415443] binder: undelivered TRANSACTION_ERROR: 29189 03:36:09 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:09 executing program 5: r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/autofs\x00', 0x400000, 0x0) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$FIBMAP(r2, 0x1, &(0x7f0000000000)=0x8001) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r3, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:09 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:09 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) flock(r0, 0xa) flock(r0, 0x2) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:09 executing program 4: r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000140)='/selinux/mls\x00', 0x0, 0x0) getsockopt$EBT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x80, &(0x7f0000000180)={'broute\x00'}, &(0x7f0000000200)=0x78) socketpair$inet_tcp(0x2, 0x1, 0x0, &(0x7f0000000080)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = open(&(0x7f0000002000)='./bus\x00', 0x141042, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000100)='./cgroup/syz0\x00', 0x1ff) fallocate(r1, 0x1, 0x0, 0x10000101) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000040)) getpgid(0xffffffffffffffff) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000240)={0x2, 'ip6gre0\x00'}, 0x18) ioctl$sock_inet_SIOCGARP(0xffffffffffffffff, 0x8954, &(0x7f0000000180)={{0x2, 0x4e24, @broadcast}, {0x1, @random="59a310eebccc"}, 0x0, {0x2, 0x4e21, @broadcast}, 'team0\x00'}) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) getsockopt$inet_opts(r0, 0x0, 0x9, &(0x7f0000000540)=""/4096, &(0x7f0000000280)=0x1000) r2 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x82) r3 = memfd_create(&(0x7f0000000480)="00eb0c432d0174df5f00", 0x3) pwritev(r3, &(0x7f0000000340)=[{&(0x7f0000000040)}], 0x1, 0x81806) ioctl$UI_END_FF_UPLOAD(r3, 0x406855c9, &(0x7f0000000380)={0x10, 0x8001, {0x57, 0x0, 0x6, {0x0, 0xfc}, {0x2, 0x2}, @ramp={0x9, 0x2, {0x3, 0x6, 0x5, 0x7}}}, {0x53, 0x0, 0x5, {0x3, 0x6d}, {0x100, 0x1}, @period={0x0, 0x80000001, 0x100, 0xfffffffffffffffc, 0x0, {0x3, 0x7, 0x3, 0xfffffffffffffe01}, 0x1, &(0x7f00000002c0)=[0x8001]}}}) ioctl$LOOP_CHANGE_FD(r2, 0x4c00, r3) sendfile(r2, r2, &(0x7f0000000000), 0x2000005) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f00000000c0)={0x3, 0x1, 0xffffffffffffffff, 0x3, 0x9}) creat(&(0x7f0000000040)='./file0\x00', 0x0) 03:36:09 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) mincore(&(0x7f0000ffe000/0x1000)=nil, 0x1000, &(0x7f0000000000)=""/105) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:09 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 401.528397] device lo entered promiscuous mode [ 401.531358] binder_alloc: 10138: binder_alloc_buf failed to map page at 20001000 in userspace 03:36:09 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x101000, 0x0) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000180)='team\x00') getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f00000001c0)={{{@in=@rand_addr, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in=@rand_addr}}, &(0x7f00000002c0)=0xffffffffffffff28) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000740)={{{@in=@loopback, @in=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in=@dev}}, &(0x7f0000000300)=0xffffffffffffffcc) getsockname$packet(r0, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f00000005c0)=0x14) accept4$packet(0xffffffffffffffff, &(0x7f0000000880)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000008c0)=0x14, 0x800) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000900)={'team0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000980)={'tunl0\x00', 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000009c0)={{{@in6=@mcast2, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@local}}, &(0x7f0000000ac0)=0xfffffffffffffd4e) getsockname$packet(0xffffffffffffff9c, &(0x7f0000000bc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000c00)=0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000c40)={'nr0\x00', 0x0}) getsockname(r1, &(0x7f0000000c80)=@can={0x1d, 0x0}, &(0x7f0000000d00)=0x80) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000d40)={{{@in=@loopback, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in6=@remote}}, &(0x7f0000000e40)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f0000000e80)={'team0\x00', 0x0}) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000001040)={{{@in6=@dev, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6=@local}}, &(0x7f0000001140)=0xe8) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000005040)={'yam0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffff9c, 0x8933, &(0x7f0000005080)={'rose0\x00', 0x0}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f00000050c0)={0x0, @local, @remote}, &(0x7f0000005100)=0xc) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000005340)={0x0, @multicast2, @remote}, &(0x7f0000005380)=0xc) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x15, &(0x7f00000053c0)={@mcast1, 0x0}, &(0x7f0000005400)=0x14) getpeername$packet(0xffffffffffffffff, &(0x7f0000005440)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000005480)=0x14) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x14, &(0x7f00000054c0)={@loopback, 0x0}, &(0x7f0000005500)=0x14) getsockname$packet(0xffffffffffffff9c, &(0x7f0000005600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000005640)=0x14) sendmsg$TEAM_CMD_NOOP(r2, &(0x7f0000005dc0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x801000}, 0xc, &(0x7f0000005d80)={&(0x7f0000005680)={0x6f4, r3, 0x100, 0x70bd2a, 0x25dfdbfc, {}, [{{0x8, 0x1, r4}, {0x1dc, 0x2, [{0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r5}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffff9}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r6}}, {0x8}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8, 0x6, r7}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r8}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x64a}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0x1}}}, {0x3c, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0xc, 0x4, 'random\x00'}}}]}}, {{0x8, 0x1, r9}, {0x198, 0x2, [{0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r10}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x1}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r11}}}, {0x74, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x44, 0x4, [{0x8, 0xef, 0x6, 0x8000}, {0x4, 0x4, 0x10, 0x817}, {0x7, 0x1, 0x7f, 0xffffffff}, {0x100000001, 0x5, 0x5, 0x8}, {0x8, 0x3ff, 0xa0, 0x5}, {0x6, 0xff, 0x9, 0x7fff}, {0x10001, 0x1, 0x5}, {0x9, 0x9, 0xffffffffffffffff, 0x8}]}}}]}}, {{0x8, 0x1, r12}, {0x44, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x3ff}}, {0x8, 0x6, r13}}}]}}, {{0x8, 0x1, r14}, {0xf8, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r15}}, {0x8}}}, {0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r16}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x3}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffff7}}, {0x8, 0x6, r17}}}]}}, {{0x8, 0x1, r18}, {0x84, 0x2, [{0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r19}}, {0x8}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x401}}, {0x8, 0x6, r20}}}]}}, {{0x8, 0x1, r21}, {0x17c, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r22}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8, 0x6, r23}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x5}}, {0x8, 0x6, r24}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x8f}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x8}}}]}}]}, 0x6f4}, 0x1, 0x0, 0x0, 0x8000}, 0x800) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB="0063404000000000000000aa00000000000000000000000000000000000000000000000000000000000000000000000000000000191fe2f4f319e87046ec788204fb6c34c9b9e487ae136ef98396a6b7f55c970ccfb08cfaf27856247625aa323ddeee6b91013b538187a1b38b44237e7388cee5845730188e3c25ea2d685cbcfd142c1586da4d72322f9ffab83c5310385cd255710000000000000003037d0fd967da2baac65deaa2dc28901a79e7bfed23a3d0e211f12675ee87341c2a3b06c378fd664303de623c027ba120f9b6918e0064bd2f6347925e88c4c3d55cbfe1d4fcee296f455d170300a793eb9f5c75360dcea5", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) r25 = dup2(r0, r1) ioctl$BINDER_WRITE_READ(r25, 0xc0306201, &(0x7f0000000080)={0x2c, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0f630c400500000004000000000000000e630c40040000000300000000000000106308400400000000000000"], 0x22, 0x0, &(0x7f0000000040)="c880d55c1ed6552052f2dd82fb25534003521049004ff151a13ce34cf2b487d55bb2"}) [ 401.534364] binder: 10138:10143 transaction failed 29201/-12, size 0-0 line 3136 [ 401.536237] binder_alloc: 10138: binder_alloc_buf failed to map page at 20001000 in userspace [ 401.536276] binder: 10140:10142 transaction failed 29201/-12, size 0-0 line 3136 [ 401.536727] binder: undelivered TRANSACTION_ERROR: 29201 [ 401.539249] binder_alloc: binder_alloc_mmap_handler: 10138 20001000-20004000 already mapped failed -16 [ 401.549125] binder: BINDER_SET_CONTEXT_MGR already set [ 401.549134] binder: 10138:10143 ioctl 40046207 0 returned -16 [ 401.550814] binder_alloc: 10138: binder_alloc_buf, no vma [ 401.550834] binder: 10138:10147 transaction failed 29189/-3, size 0-0 line 3136 [ 401.551206] binder: undelivered TRANSACTION_ERROR: 29189 [ 401.551322] binder: undelivered TRANSACTION_ERROR: 29201 [ 401.598780] binder: 10149:10152 transaction failed 29189/-22, size 0-0 line 3013 [ 401.598974] binder: undelivered TRANSACTION_ERROR: 29189 [ 401.625863] binder_alloc: 10155: binder_alloc_buf, no vma [ 401.625882] binder: 10155:10156 transaction failed 29189/-3, size 0-0 line 3136 [ 401.656121] binder_alloc: 10155: binder_alloc_buf, no vma [ 401.656142] binder: 10155:10162 transaction failed 29189/-3, size 0-0 line 3136 [ 401.656326] binder: 10155:10162 BC_CLEAR_DEATH_NOTIFICATION invalid ref 5 [ 401.656338] binder: 10155:10162 BC_REQUEST_DEATH_NOTIFICATION invalid ref 4 [ 401.656348] binder: 10155:10162 BC_DEAD_BINDER_DONE 0000000000000004 not found [ 401.656807] binder: undelivered TRANSACTION_ERROR: 29189 [ 401.656830] binder: undelivered TRANSACTION_ERROR: 29189 [ 401.770384] device lo left promiscuous mode [ 401.776400] device lo left promiscuous mode [ 401.827818] device lo entered promiscuous mode [ 401.836784] device lo left promiscuous mode [ 401.843120] device lo entered promiscuous mode [ 401.854362] device lo left promiscuous mode 03:36:09 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x2, 0x0) accept4$packet(0xffffffffffffff9c, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14, 0x80000) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f0000000140)={{{@in6=@local, @in6=@local, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}}, &(0x7f00000000c0)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000480)={{{@in=@loopback, @in=@multicast1, 0x4e24, 0x5, 0x4e21, 0x1, 0x0, 0xa0, 0x0, 0x33, r3, r4}, {0x3, 0x6, 0x1, 0x8, 0x7, 0x2, 0xffffffffb625a27b, 0x3}, {0x3ff, 0x3f, 0x8a37, 0x9}, 0x2, 0x6e6bc0, 0x1, 0x0, 0x1, 0x3}, {{@in=@multicast2, 0x4d3, 0x3c}, 0x2, @in=@dev={0xac, 0x14, 0x14, 0x1c}, 0x3502, 0x3, 0x1, 0x5, 0x1000, 0xfffffffffffffe01, 0xca76}}, 0xe8) 03:36:09 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:09 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f757024"], 0x7e) 03:36:09 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:09 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/mls\x00', 0x0, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) ioctl$ASHMEM_GET_NAME(r1, 0x81007702, &(0x7f0000000400)=""/4096) r4 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/hwrng\x00', 0x4000000000003fff, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r5) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r2) 03:36:09 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffffff, 0x29, 0x22, &(0x7f00000001c0)={{{@in6=@dev, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@remote}}, &(0x7f0000000000)=0xe8) setuid(r1) 03:36:09 executing program 5: r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='fd/4\x00') utimensat(r0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000240)={{0x77359400}, {0x0, 0x2710}}, 0x100) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x7, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) poll(&(0x7f0000000000)=[{r2, 0x41}, {r1, 0x20}, {r1, 0x100}, {r1, 0x4}], 0x4, 0x3) socketpair$inet_icmp_raw(0x2, 0x3, 0x1, &(0x7f0000000040)={0xffffffffffffffff}) setsockopt$inet_mreqsrc(r3, 0x0, 0x25, &(0x7f0000000080)={@remote, @multicast2, @multicast1}, 0xc) fchdir(r2) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:09 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:09 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 402.048848] binder_alloc: 10170: binder_alloc_buf failed to map page at 20001000 in userspace 03:36:09 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 402.059701] device lo entered promiscuous mode 03:36:10 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 402.062065] binder: 10172:10178 ioctl c0306201 20000440 returned -14 [ 402.065001] device lo entered promiscuous mode [ 402.070326] device lo left promiscuous mode [ 402.074667] device lo entered promiscuous mode [ 402.080929] device lo left promiscuous mode [ 402.120122] binder: 10188:10189 ioctl c0306201 20000440 returned -14 [ 402.150373] binder: 10191:10192 ioctl c0306201 20000440 returned -14 [ 402.214783] binder_alloc: 10170: binder_alloc_buf failed to map page at 20001000 in userspace [ 402.224067] binder: 10170:10181 transaction failed 29201/-12, size 0-0 line 3136 [ 402.234414] binder_alloc: binder_alloc_mmap_handler: 10170 20001000-20004000 already mapped failed -16 [ 402.244390] binder: 10198:10199 transaction failed 29201/-12, size 0-0 line 3136 03:36:10 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:10 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 402.253165] binder: undelivered TRANSACTION_ERROR: 29201 [ 402.269279] binder: BINDER_SET_CONTEXT_MGR already set [ 402.277839] binder: 10170:10202 ioctl 40046207 0 returned -16 [ 402.283917] binder_alloc: 10170: binder_alloc_buf, no vma [ 402.289866] binder: 10170:10181 transaction failed 29189/-3, size 0-0 line 3136 [ 402.289897] binder_alloc: 10170: binder_alloc_buf, no vma 03:36:10 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:10 executing program 6: r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r0, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) sendfile(r0, r0, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 402.289915] binder: 10204:10205 transaction failed 29189/-3, size 0-0 line 3136 [ 402.290372] binder: undelivered TRANSACTION_ERROR: 29189 [ 402.316960] binder: undelivered TRANSACTION_ERROR: 29201 [ 402.318195] binder: 10207:10209 transaction failed 29189/-22, size 0-0 line 3013 03:36:10 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x80000, 0x0) ioctl$TCSETS(r1, 0x5402, &(0x7f0000000040)={0x9, 0x6, 0x4, 0x3, 0x6, 0x2, 0x101, 0x8, 0x7, 0x101, 0x86a, 0x6}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) [ 402.318388] binder: undelivered TRANSACTION_ERROR: 29189 [ 402.347144] binder: 10211:10212 ioctl c0306201 20000440 returned -14 [ 402.376640] device lo left promiscuous mode 03:36:10 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockname$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast1}, &(0x7f0000000080)=0x1c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000380)={0x18, 0x0, &(0x7f00000000c0)=[@enter_looper, @register_looper, @clear_death={0x400c630f, 0x2, 0x3}], 0xad, 0x0, &(0x7f0000000240)="7b59255dfc199524e8ab76697e08dc5a2fcade2a5b3f37026bd86837a52ecdf6ad7ba54cd5381846c9119ec4aa22fc5d19386b9b051c11b8b6e3069216d09cd5b64b6df019c7871620be9b077b9a4616dc779657fb79aafb1d02a20ce3ff87c30620fee3d0fee29d5f6c85ff443ab4eebf8539e010667e0b2b1ed9cc6f690c9e9d8b3b24535745f4c26a48fc461bd97e9873792c33c2d484f359c30bb769d2d0a2eed927f107835affebeabe5d"}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = creat(&(0x7f0000000140)='./file0\x00', 0x1d) sendmsg$nl_xfrm(r2, &(0x7f0000000200)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000480)=@getsa={0x1ec, 0x12, 0x2, 0x70bd29, 0x25dfdbfc, {@in=@rand_addr=0xff, 0x4d5, 0x2, 0x6c}, [@migrate={0x1bc, 0x11, [{@in=@local, @in=@remote, 0x3f, 0x0, 0x0, 0x3504, 0x2, 0x2}, {@in, @in6=@dev={0xfe, 0x80, [], 0xe}, 0xff, 0x3, 0x0, 0x3506, 0xa, 0x2}, {@in=@remote, @in6=@mcast2, 0x0, 0x1, 0x0, 0x3500, 0x2, 0x2}, {@in6=@mcast2, @in6=@ipv4={[], [], @rand_addr=0x1}, 0x33, 0x4, 0x0, 0x3506, 0x2, 0xa}, {@in6, @in=@multicast1, 0x33, 0x7, 0x0, 0x3506, 0x0, 0xa}, {@in6=@local, @in6=@remote, 0x32, 0x3, 0x0, 0x3500, 0xa, 0xa}, {@in=@rand_addr=0x9, @in=@local, 0xff, 0x7, 0x0, 0x3507, 0x2, 0x2}, {@in6, @in6=@mcast2, 0x6c, 0x2, 0x0, 0x0, 0xa, 0xa}, {@in=@rand_addr=0x6, @in, 0x6c, 0x7, 0x0, 0x3506, 0xa, 0x2}, {@in6=@mcast1, @in=@remote, 0x3c, 0x0, 0x0, 0x3502, 0xa, 0xa}]}, @extra_flags={0x8, 0x18, 0x5}]}, 0x1ec}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:10 executing program 6: r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r0, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) sendfile(r0, r0, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 402.400859] device lo entered promiscuous mode [ 402.403961] device lo entered promiscuous mode [ 402.407431] device lo left promiscuous mode [ 402.425895] binder: undelivered TRANSACTION_ERROR: 29189 [ 402.465706] binder: 10223:10225 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER [ 402.485293] binder: 10223:10225 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 402.503306] binder: 10223:10225 transaction failed 29189/-22, size 0-0 line 3013 [ 402.511918] binder: 10223:10225 ERROR: BC_REGISTER_LOOPER called after BC_ENTER_LOOPER [ 402.520741] binder: 10223:10225 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 402.527787] binder: BINDER_SET_CONTEXT_MGR already set [ 402.533171] binder: 10223:10228 ioctl 40046207 0 returned -16 [ 402.540133] binder: undelivered TRANSACTION_ERROR: 29189 [ 402.548455] device lo left promiscuous mode [ 402.568961] device lo entered promiscuous mode [ 402.579916] device lo left promiscuous mode 03:36:10 executing program 4: r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) getsockopt$inet6_tcp_int(r0, 0x6, 0x18, &(0x7f0000000280), &(0x7f00000002c0)=0x4) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) socketpair(0x1f, 0x80a, 0x81, &(0x7f0000000300)) sendmsg$nl_route(r6, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRESDEC=r5], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r7 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r1, 0x4c00, r7) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2) ioctl$sock_proto_private(r4, 0x89ea, &(0x7f0000000180)="de70fdfc85d0ab") 03:36:10 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f757024"], 0x7e) 03:36:10 executing program 6: r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r0, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) sendfile(r0, r0, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:10 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x0, 0x0) accept$packet(r2, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x802) ioctl$KIOCSOUND(r2, 0x4b2f, 0x7e0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:10 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0x0, 0x3a000) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) [ 402.896418] binder_alloc: 10236: binder_alloc_buf failed to map page at 20001000 in userspace [ 402.905357] binder: 10236:10237 transaction failed 29201/-12, size 0-0 line 3136 [ 402.914347] binder_alloc: binder_alloc_mmap_handler: 10236 20001000-20004000 already mapped failed -16 [ 402.924717] binder: BINDER_SET_CONTEXT_MGR already set [ 402.926435] device lo entered promiscuous mode [ 402.930650] device lo left promiscuous mode [ 402.939075] binder: 10236:10241 ioctl 40046207 0 returned -16 [ 402.945972] binder: undelivered TRANSACTION_ERROR: 29201 [ 403.040584] device lo entered promiscuous mode [ 403.048261] device lo left promiscuous mode [ 403.351239] IPVS: Creating netns size=2536 id=94 [ 403.539992] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 403.578786] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 403.640278] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 403.654126] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 403.716249] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 403.730680] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 403.745880] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 403.764187] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 404.436420] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 404.470974] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 404.477703] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 404.484354] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:36:13 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:13 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="030000f3ffffff000800fce4cafe61aaa4031b0008000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:36:13 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:13 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x220000, 0x0) getsockopt$inet6_mreq(r1, 0x29, 0x0, &(0x7f0000000040), &(0x7f0000000080)=0x14) ioctl$SG_SCSI_RESET(r1, 0x2284, 0x0) 03:36:13 executing program 4: r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) getsockopt$inet6_tcp_int(r0, 0x6, 0x18, &(0x7f0000000280), &(0x7f00000002c0)=0x4) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) socketpair(0x1f, 0x80a, 0x81, &(0x7f0000000300)) sendmsg$nl_route(r6, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRESDEC=r5], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r7 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r1, 0x4c00, r7) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2) ioctl$sock_proto_private(r4, 0x89ea, &(0x7f0000000180)="de70fdfc85d0ab") 03:36:13 executing program 5: r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x6, 0x100, 0x0, 0xe, 0x1a, 0x9, "c6abd4925f3295818a2aa826de1d85bbdbef2e271c45892ea4f9efdb0aa27d5e8ca23a7fa1fa3956c737b6449b4ff1b0c0dd673440c18581ab3ab03b710dae3e", "36c0a292d253b736524bcf9c2ac09f2a1ecf0bf1911f0bd84988b61efe27a3a71482ad21fc0f4553a8160de1ddeefb4f153f4cdb762e8c58264d443cbd00199a", "cac35c7f13764c88b04544f5dcc7e2aadde962528fc63adcf26b64a77505aa1f", [0x2, 0x1]}) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0xfffffffffffffffe, 0x80000) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x600400, 0x0) ioctl$RTC_WIE_ON(r1, 0x700f) r2 = socket$inet_tcp(0x2, 0x1, 0x0) clock_gettime(0x3, &(0x7f0000000080)) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000040)={"6c6f00000000000000000000000200"}) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000540)={'filter\x00', 0x7, 0x4, 0x4a8, 0x140, 0x140, 0x280, 0x3c0, 0x3c0, 0x3c0, 0x4, &(0x7f0000000000), {[{{@arp={@multicast2, @remote, 0xffffff00, 0x0, @mac=@local, {[0xff, 0x0, 0xff, 0x0, 0xff]}, @mac=@random="fb9fa4ec2ee1", {[0xff, 0x0, 0x0, 0xff, 0x0, 0xff]}, 0x3, 0xfff, 0x5, 0x8, 0xb724, 0x9ef, 'bridge0\x00', 'rose0\x00', {0xff}, {0xff}, 0x0, 0x100}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @dev={0xac, 0x14, 0x14, 0x15}, @dev={0xac, 0x14, 0x14, 0x12}, 0x4, 0x1}}}, {{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @remote, @loopback, 0x2, 0xffffffff}}}, {{@uncond, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@broadcast, @empty, @loopback, 0x0, 0x1}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4f8) 03:36:13 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f757024"], 0x7e) 03:36:13 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = memfd_create(&(0x7f0000000000)='/dev/binder#\x00', 0x2) fcntl$getownex(r2, 0x10, &(0x7f00000001c0)={0x0, 0x0}) getpgrp(r3) getsockopt$EBT_SO_GET_INIT_INFO(r2, 0x0, 0x82, &(0x7f0000000040)={'filter\x00'}, &(0x7f00000000c0)=0x78) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000050000000000000000000000ffffffffffff0fe0000000000000000000b10000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:13 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:13 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x4d, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000009867ebcc0000000000000000000008000000000000000000020000000000d3e214067545b9a3ae", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYRES64=r0], 0x0, 0x0, &(0x7f0000000200)}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x200, 0x0) mq_notify(r2, &(0x7f00000001c0)={0x0, 0x21, 0x4, @thr={&(0x7f0000000480)="690a50e76b756f543c43745dd095909e28e59c2ed888e6a91fc31b13597ec80a9389fab57ec559f04faa5dab1fe7d33706e625f869276806274c56c4c78691842e56fc96d5cf6be1d9949e0184dfd029dfb0d60423b550852e658990b4651f4e2de02d24f1c494fd67126d1aa35fb84e1db93ffa22893451775e966d46c3af21821b0233bb0e78d2f9de40def414c39bb45ebc3a4a9e7bb97c821b63a827a37bd55e2d4e5a2bd84b37870ebbb8102e05d3086fcdfed3a282510c9351555ac1b28b77f4d69d2a7843ca093249c56ca9837c466cd3dfcf21a6787d150936e5f0da164fd98967fb912af6de0d411d053d9f8c7d55307f4b3d836f3622c170c4037e9f502ddc6c242e0b15402e87f9220524d26567691fd61174714dfb2b40d628a66fc5bb527a45780071a7da3bd2f48543a5d99fd72d141c556afaa67aadc1f4b6368ea92c18680b390409e9b6304c85d6bfe245bc1b0eb07c47589fca1f5dac3f92ec4e73905ed9a3dd74594cfbfd626569075fc6976bf0c8c03c976173666a6fb7f089e1e9fcb12659fbb9965930820cdf60a811ba80d0c94a0b4bd052aa06931e67bb9315ac54ed7ecf4dd3ed5dcd417898ef29445b97128f039600d355800a966ede75f660fa43f90389925323e34179ead680d813e5f1fdf6db4ee5ffb1b19a795bbe1cba7f6458c14367cdaad63c95e0e8b4ea623c2bd7c781370e856bd790d813b0d4d7f0995643dbf026c437ff45affc68bc86f7101f1bb573409cd1dc847a3082708999ef528c2866a0aff732d27cd29086a822c1e8c9186a0ff378263ea68f0be955451b76c1920146873277ed657e290d4e443221c1f16ef7aafceee10fc9b0318b63ecbfbcb5705faffbd4252e1b27fc7607f867f887b2cac308f5ef64bddd8bf15b40721ee7b749469e7156dde9f3095102d972b0bf801ceab5b062dbf67ee02562aa5de80ccfaf22d3e644f46cde4865328352086002390dabfb22a6bde1eed859ff25fc1e3a5f8ca39dc4d56800fe2ab272a28f71d0560244665c7b1e928f50e6ded03dd4cf62a89a650f57b3a55c9774fce77325eb8e7025ac9ac22f42dfc2ad73b2e68239483d8b3edfffa51284765941a6e995304ae877c3763a85999334c9c11a52657ae0ea1f4d22f14e10519130116d68965f4c908a0d81ac053a8b18d2189ff50a35704c9205a494d60e5727d9b452998203c64905d2c81a41eb4d3b595a724f49ea90fccfce544978e8874300d539bae7f64688556b99e080956d747678a0423459a65007aecf8e3ceaf2a747c53a189894793dfdd400000a015c148b07e35c66f0cca2c17492a897128c90a2a902fcb22b2c5b6265d29268fc3c22090ff7ab545bff9b731503816c554cdfa0193bbd5d92a1cafc5a8e4eb652fcb0500b6e5b25ca00d80f24c6058cd9135f1930e91b0e267a693cb9cccbeac951b185f3cc344713485bb19e458aec739e77d43c7749e7558ec84821acbd759c737eba5345307ce9532d29f0ae4dba5eac7926c6b7f6a14a7a919bbac67eaf6acbd1f589d3b0cf630923cd1fed6a60f09cc843aadf202d18bbdb2423deb844abe547c12ff82d89a9c8fd484a81c483fe71444c797527c38a8761d9544984cbe97220325261622187a63eba27e76c71073d8f365f42b8ac434d1f7646545e9a263f37c3bd87cd1ade1babb5ea3a7f29184fa147acc9d4ca5e9bc990a3845b58c99df07d6165b86d12da28308794edba6472441b70077f5e1e1f0891627ac05ff747a81f13382274a6d93f3c52387742c0a4ff89c3bb2edb42b5b68872ffbd836dff75097719f5eabd494e4f80ad38a9332e8434d7fb2c368020f457d444026bdb4cf776f939958346e231660cf615be73c725f15ce3b600d2eb9894866bccdf49af9257f6048cc604f214f6ab127a230c0140cdddfcf89b5ed32fd068e21cad40b2493bf690615975564619032384cbc8223f8867198e5ed4923fc1bf85075d16323b0667cbdaa2a374a7affb4697951c7aa2319fbbf7c26e18304b3cd4eda7fc2010a7d5554cee1c90e0251bda2b6cf14d18ec15570ad0e027217e7d047c6a7653a9fbb9fc12bf5b5b6b97e4ecfd44e00c9dc5b61c4daeb39b2f93ca68158227d9e9bcbbb33bd8046e26b660f0b7aa519f8e6d5a2bd1b7ede4d6143c5343799ed42f066d1f221ea8e4772b1a1a97cf10fea11f0b74cc201619abb322131635e55637932c834f87361c930a5a55b058b8baed11b2b697272511de8cf45bad67bb2418305fb8088100aafbbc5a8cf8a5f2a9c8c2411212b3416d2fcec376fc4375be86339911430be4ba85cd15f3cf904bb78686b23f77b7e83e9e67c6c198203e47dd93ce979577b202bc2f6f0c3f660a905801bd5e6c241c350f61767af60160ee702b054f8b5acb91e55039a635de43c464ba87f68365a9f8b40303d31ed752390e47e443e0b398dd706c0041877adbbba02270e1bf9c47bc34bfe169b7e6b6003ff026193dd555f156577b36d91cc0b70f49ff745f7e2624e56c0bbf8bddea88624cf52746afd39999c04ebb7c5bc83f1bdcd041e980ba71751aaf7673616c007b0285c3e1defa3f4932480fce7aa72971a89aace16ea63eadf5851ab4a89f60da0049d52a3e00644e30c46c9d6d0cbaaedbec8e934b37b7326dbc170f65a568b240db36fcd0fc8fbdb07cfc1f3071f9f35e2fc547c42bd9115911185eaadc422e80c048c3be9919a4ab5ddb7f0ce763383a76849767634a96429b3bec89159ce74f064a257017312cba73f09d0203a1bc4d28fdebe92efa624e32565475908d005a4ae850f9bcf011b826879ee6f992c2766173a1b546d79e2ff1089f9ead16c107ed4b846310ee6c300579ffd4615932dfab1edbabed853d932b69ddd63dd15ee59f4b637c0f06490046372c7c2b027578a4fff726d7f41716c5cb25f3ae713ad5d8e20144db25095a06adba536e0ac6311ed272957a2ad2149a5d92f55391e62d5bd684e6ddcdf50ee63cc506472ece342c1a8c1822d7788b8407e53b423bc11bfa0ead3b2faee24d8854e720634687beb4a85713eaa743dfc392310586a98c1fe27f4d7de0bfe36cafc2711764ca53e0365770e8d077a599060b433a30ff9498f27e0698115e07f1cf93e1de32de5f286119fd66de47ffef30703412c08ad4555f6c09d0a4b3c8774101e69f2d1613b399c2a038375a57d77abea7dd2dd625900df6ea54b702060e3c316ea92e05187f665a70a199204fe2aafc7b60c2d184372f3778a63dd3d677396047219ba18be5dc22b10d74c4094cd4640e7fb5394a5abc85b39004486018584c4601ae4f94abb7977f480110e5eac4bd937154adfaed4b5ca7c787d1814d4b737953ac63dbe5a2bb55ab0ac23900ce7119af8faa7bc35c73ca5fb1bc97c7470063ae7b5e17915ce48e67aca5c891c4fbb55421de480c829587525234da8bee910cd92ef85127cbc3edf4bc8eb46887646a10773fcb9db66195714c1ea86a06a3794ff5deda802685ca3d4f44ccc309def88746e51e3b5f5ee9faf59bf77bec50a0a60bb3e8041ba63034a9b50dda90a0acc3e25b96d3fc5c803951dc05b5b3f9ca8f4066109b15a55e4e9e4e45a24a28ba834616551fca8bcb87d2c5dac3d347fe7e017e1fad351b20a6a19f2108cd8dd6d7ae9bfbd6ce2c1c6dfd867c2fd4734b081178afaccd5d3af967a3785220f8ebf317705782f63bfb8f366d40eb64c392f4ca868da60b2607954dc464adb6284ab7240b497b31053864b154c38037faed44b204231fc25499a253c9d35c936cf41120b534f0745e296a8cb5ffcf3e7e4f235ee71067def52a017c254875e88187606b1525adfd50aacbc1b19d9aa44c6ab23f4573f8b84279b848c5a92c72ebdfbb8bb7f9d58fd3c1f9eb32925417f0fe5ccdcea4d2e3b772d4a1397abb0e1d55264f98d3cb83692411f48c22bc9c01b7118d353ccd2b6c4551b1f7760bc0f734fb8fd5fe031a1b3e70aca53f14352c06ed62a63fb638c7f1a9cfd2b50b33075abf08d5d47e193eebc45a6917620ab42d03eec24f95986e6553c8545ef7ee7c5078de3608bda2b8b2f2fc6eb1b4838ea21af830efbddc66dd94b08650ebe7df2354c64fbebcdd84cd4568233c9d0efd4ae558aff1259ee312ac28baa198e54679a37efd5edfa475e49deab4e12ca9d96ea261b461eb87f3a72a7b72a0c38cd2f0a3d159d45bc386bcb1d2fe7293e962d434c446fbc76852fbb48dfab26b0cbefcf95dba08d06b82a12b74e08df12dd59a5a1aa34956b91e3b6d9eb4c35650cd441f3a16da26686a09c5087bc4694d1af6841fa1bf9f8f715de0a0a9f5a92007122e5059d3f22ec1de916f5a617caf3a462ad969562589e4588eb4796949f32eb34dd380e19f1522c2e745c64ea15bd4ad6573f1daf0254a73947a6743a703b7780f5f84964bf119a8b730ce0a12f0b90b91deefd21d63000650404110fbdc3e12e9314e4fb948a8eeb0598a4a2332e65d24d3e6fcf3d7fe2a6fe48a2c092be4d5f8805486c052ba510f33a5ea750c304e8b1b2ea92b3ddf6e4c416306012495cc8613b83657278383dd98bb5d04871fc6ba2a5e00e081cb1c0a7636ab29bc3319f9400dc22dcda0b6ac08517be966f903affe80dacb240425f5f4483c205e21e7ba104e93bdb4e388c7239e8302d59ff1a3074b7db91b936c86ea50f0adebd57b6199444ebcf0393c1e923e439af68bba5274c4518b34a87926571987d4688ef5d2e1d33fe5f84ade44c047ce8139f28a801c7753c45687f66320c0825cbeb1fbfdfd47bd5d594a5c67219d23e0a9bac805459b52c1b8366b5aaea6d9cb0925b49a67ddf3ec38a270b3f680564627e32b748f710488813a52bd820e967e2b8ca566faa7641631c2c385d8fbed37be59e7c3bbd0e91f2fb70e1964919cd8f15da92dc123ec4ce4efd16abaf2178a90c7b0c5b6027513be04173364e9a644e3aa738d0ae81ade644f10842db2d4b927061872a931326010df4ddf67aaea6030e09d81ac5c607f4008a210aad674e6faccc4486f71391bb05b0d043ac46210d5c542c3fddba64140d8453e845de3da0fbf093fa8950cb70feceeca1944a95058f385170c7d94bc0ed6d4ee06e50ab5a903e80f752a2af90333b87df8849d1e4f7e12c596f69dbc2f5f4cfedfe52acf77b5351a9fbde64ccfb62afd10164744e7bce9185e188e818296c8dab41022890550508e04bd027cd19130252c60c94a74db31fef5701019aa43219784d1b0f252d9f21958d5978a61a4573eec1ca3f0ee36684748511bda39d76e3ee76fa38d92fdee881d94414f4cea4012accbeef3c8a2b0e11306bcbebbadb470beaf0cd92a41cf467307dbf2dc8fbef50f5abc009efcfe99c62ff2851a61ef8085511ff6907e6bb9b056889d5eaf54e373b1d8997bc652d800a6c9619e3339a6bf97c8e92f9c806c21fdbb280c5ce2bb7530869f0d29b9494d6ac2d957c698f71c942e10495ba28398e748b8c033ccc936430668d791bdf95d09e8dfdc8cfbdc1b7c8773be4022191014b0b84f9be6374fd09215a4f216cf5eed7ad6850bd5bd3b54b03ed0a20e5ddcafa4c329fcbd20f43ce58b17fb22326244a2fbc6afd5f16cfae1033cfe5b4d75483566a0a1a74158062d6ea34dd6f0601632f0d4be0b78db10fd4daab63cade29a13d411a4321de4c13aadb347985566108079f2bd9d3692031116d6f4173f52178e3ef80e6b377f542d3766d0a8caedd81d0cb5a01497f1fc927a5986c0b969af4e213c287b5412222a1153", &(0x7f0000000040)="2ddd9ca26c8c2f1a0fd68a3b68602b8b09da76b98865b5669e8f66dcac94a3298a553cdc20771de1106e49e9aea5259c627b7fcad2b9a4a500a106f45ef0e7dd4fe0f86689c16243769fab2900359cd92d6a9724983bea9036a07d8c5c3801041ff5b655f09194da6a9432aaa2d5ae32bf646ba589c273d6ee01e5a4093155ba1bda706bb29afdeac306fff18f8e000a975d8c3da52f7e2cce760a1930814fc4f244130564c6eda0872782d6"}}) [ 405.561902] device lo entered promiscuous mode [ 405.568920] binder_alloc: 10631: binder_alloc_buf size 49822033218895872 failed, no address space [ 405.568927] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) 03:36:13 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c5c3fcb185a36d20d52d097399fd15648c6641aa80f04", 0x2c) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:13 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ftruncate(r1, 0x0) [ 405.568946] binder: 10631:10636 transaction failed 29201/-28, size 962341109759-49821070877786112 line 3136 [ 405.571444] binder: 10629:10635 ioctl c0306201 20000440 returned -14 [ 405.579688] binder_alloc: binder_alloc_mmap_handler: 10631 20001000-20004000 already mapped failed -16 03:36:13 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:13 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socketpair$inet6(0xa, 0x0, 0x8, &(0x7f00000000c0)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'syzkaller1\x00', 0x0}) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200)='/dev/rtc0\x00', 0x1000004000000b00, 0x0) ioctl$TUNGETVNETHDRSZ(r3, 0x800454d7, &(0x7f0000000040)) ioctl$sock_inet6_SIOCSIFDSTADDR(r1, 0x8918, &(0x7f0000000180)={@ipv4={[], [], @multicast1}, 0x7b, r2}) r4 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r4, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r4, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000c9c11e00000000000000000000000000000044a5c78774dad3", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:13 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 405.579790] binder: BINDER_SET_CONTEXT_MGR already set [ 405.579798] binder: 10631:10638 ioctl 40046207 0 returned -16 [ 405.580416] binder: undelivered TRANSACTION_ERROR: 29201 [ 405.621633] binder: 10643:10646 transaction failed 29201/-28, size 8-131072 line 3136 03:36:13 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x800000000000802) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x0, 0x100000000020011, r0, 0x0) r2 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x200000, 0x0) ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f0000000040)={0x5, 0x80}) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:13 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 405.626397] binder_alloc: binder_alloc_mmap_handler: 10643 20001000-20004000 already mapped failed -16 [ 405.626794] binder: BINDER_SET_CONTEXT_MGR already set [ 405.626802] binder: 10643:10648 ioctl 40046207 0 returned -16 [ 405.627294] binder_alloc: 10643: binder_alloc_buf, no vma [ 405.627322] binder: 10643:10646 transaction failed 29189/-3, size 8-131072 line 3136 [ 405.627761] binder: undelivered TRANSACTION_ERROR: 29189 [ 405.627852] binder: undelivered TRANSACTION_ERROR: 29201 [ 405.629515] binder: 10639:10645 ioctl c0306201 20000440 returned -14 [ 405.670026] binder_alloc: 10652: binder_alloc_buf failed to map page at 20001000 in userspace [ 405.670088] binder: 10652:10657 transaction failed 29201/-12, size 0-0 line 3136 [ 405.671794] binder: 10650:10655 ioctl c0306201 20000440 returned -14 [ 405.679907] binder_alloc: binder_alloc_mmap_handler: 10652 20001000-20004000 already mapped failed -16 [ 405.680441] binder: BINDER_SET_CONTEXT_MGR already set [ 405.680450] binder: 10652:10659 ioctl 40046207 0 returned -16 [ 405.680784] binder_alloc: 10652: binder_alloc_buf, no vma [ 405.680802] binder: 10652:10657 transaction failed 29189/-3, size 0-0 line 3136 [ 405.681294] binder: undelivered TRANSACTION_ERROR: 29189 [ 405.681367] binder: undelivered TRANSACTION_ERROR: 29201 [ 405.713443] binder: 10663:10667 ioctl c0306201 20000440 returned -14 [ 405.741846] binder: 10665:10668 ioctl 8933 20000140 returned -22 [ 405.743150] binder_alloc: 10665: binder_alloc_buf failed to map page at 20001000 in userspace [ 405.743185] binder: 10665:10668 transaction failed 29201/-12, size 30-0 line 3136 [ 405.743786] binder: 10665:10673 ioctl 8933 20000140 returned -22 [ 405.749539] binder: BINDER_SET_CONTEXT_MGR already set [ 405.749547] binder: 10665:10673 ioctl 40046207 0 returned -16 [ 405.749595] binder_alloc: 10665: binder_alloc_buf, no vma [ 405.749612] binder: 10665:10675 transaction failed 29189/-3, size 30-0 line 3136 [ 405.749963] binder: undelivered TRANSACTION_ERROR: 29189 [ 405.750028] binder: undelivered TRANSACTION_ERROR: 29201 [ 405.766192] binder: 10671:10676 ioctl c0306201 20000440 returned -14 [ 405.785706] binder: 10678:10680 transaction failed 29189/-22, size 0-0 line 3013 [ 405.789835] binder: BINDER_SET_CONTEXT_MGR already set [ 405.789844] binder: 10678:10684 ioctl 40046207 0 returned -16 [ 405.790173] binder: undelivered TRANSACTION_ERROR: 29189 [ 405.809727] binder: 10681:10685 ioctl c0306201 20000440 returned -14 [ 406.007461] device lo entered promiscuous mode [ 406.016595] device lo left promiscuous mode [ 406.067391] device lo left promiscuous mode 03:36:14 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) [ 406.121447] device lo entered promiscuous mode [ 406.127662] device lo entered promiscuous mode [ 406.137774] device lo left promiscuous mode 03:36:14 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r2 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000000d2000200000000"], 0x1}}, 0x0) socket$packet(0x11, 0x1, 0x300) r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r3) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, 0xffffffffffffffff) 03:36:14 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"626f6e4c5f736c6176655f3039dd0947"}) [ 406.763682] device lo entered promiscuous mode [ 410.129285] IPVS: Creating netns size=2536 id=95 [ 410.163994] IPVS: Creating netns size=2536 id=96 [ 410.435822] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 410.454627] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 410.463589] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 410.482951] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 410.572797] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 410.591841] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 410.600031] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 410.613697] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 410.694518] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 410.702171] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 410.716891] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 410.724512] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 410.735586] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 410.747392] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 410.760818] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 410.769348] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 411.873086] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 411.879858] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 411.931875] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 411.938155] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 411.944823] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 411.953599] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 411.960994] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 411.967988] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:36:20 executing program 4: r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) getsockopt$inet6_tcp_int(r0, 0x6, 0x18, &(0x7f0000000280), &(0x7f00000002c0)=0x4) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) socketpair(0x1f, 0x80a, 0x81, &(0x7f0000000300)) sendmsg$nl_route(r6, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRESDEC=r5], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r7 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r1, 0x4c00, r7) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2) ioctl$sock_proto_private(r4, 0x89ea, &(0x7f0000000180)="de70fdfc85d0ab") 03:36:20 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063c05a000800000000000000000000000000000beaffffff000000000000000000009227fb732300000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:20 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a03983b5addde9e46e1145c", 0x16) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:20 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/autofs\x00', 0x200, 0x0) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0xfffffffffffffffc, 0x1, "0fac895cc459982d99764538cb43ac533b0b9da42670bd4976d90ee17e6d77c8f82f25dd0df52b43ec336c6f82542a6be8f84444b7c42d5cd1ebd2a712f3c849", "9cb130834eea16f3f55e08726d9aa07376b66d8675d52ae643c410f6a2f88f40", [0x2, 0xff]}) open(&(0x7f0000000140)='./file0\x00', 0x400, 0x40) r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = add_key(&(0x7f0000000340)='dns_resolver\x00', &(0x7f0000000380)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000003c0), 0x0, 0xfffffffffffffffb) keyctl$get_keyring_id(0x0, r3, 0xd1b7) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000000)) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) r4 = fcntl$getown(r1, 0x9) fcntl$setownex(r2, 0xf, &(0x7f00000001c0)={0x2, r4}) 03:36:20 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000"], 0x87) 03:36:20 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000080)='/dev/autofs\x00', 0x40, 0x0) setsockopt$netlink_NETLINK_CAP_ACK(r1, 0x10e, 0xa, &(0x7f0000000100)=0x5, 0x4) open(&(0x7f0000000140)='./file0\x00', 0x40280, 0xa0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4800) write$FUSE_OPEN(r2, &(0x7f0000000040)={0x20, 0x0, 0x1, {0x0, 0x4}}, 0x20) 03:36:20 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:36:20 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) write$binfmt_elf64(r0, &(0x7f0000000140)={{0x7f, 0x45, 0x4c, 0x46, 0x1728, 0x9, 0x5, 0x5, 0x5, 0x0, 0x6, 0xfffffffffffffff8, 0x5c, 0x40, 0x174, 0x1, 0x400, 0x38, 0x1, 0x2, 0x2, 0x3a}, [{0x70000005, 0x8000, 0x5, 0xf6cb, 0x4, 0xe8, 0x5, 0x6}], "77dd68f073fff5f9fda1f55c0cf8788ee5d54224b94b68adeb8f29dc66cc300c9d64f97a6500c5dea704c261fbc5d75ab6d975c35e8b5de45de9da17b821025b6c29cbfa0d3209b1e05ce36abddc144a927a4132cc1cb61cce437deb017315a2216345b793c51e5a94d12daf8a5adfa9e1d84940997c5a4a8fc07bb08380cddbc2c4355df6907ad41d35f9d814dd6596eb2b06883520beb4c476ab12f752703d6067d944ab916693a30190bf9a311772cc5cec2f00c3e8d7564729915ad5c1fbe5ffc099ce5dd72fee"}, 0x141) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) r2 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000040)=0x200, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:20 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:20 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000000)={0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000400)={0x68, 0x0, &(0x7f0000000380)=[@dead_binder_done={0x40086310, 0x2}, @enter_looper, @transaction_sg={0x40486311, {{0x1, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x18, 0x8, &(0x7f0000000080)=[@flat={0x77682a85, 0x0, r2, 0x1}], &(0x7f00000000c0)=[0x0]}}}, @dead_binder_done], 0x48, 0x0, &(0x7f0000000480)="1391124b26f3575428d4e0d0aa6b8518570ea9dd48cfa1379173c18a7f873a3489ff908d624cd37d42e5a6421288345b6d764ef35c1b6e1646a1c363e8f84fc25630c1cb8333480b"}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)="76d0ca22e12de601d5e004de11d5d325d9d34d99f889ab1c95122f642c9252eb1810841be04decd03a29b100000000fb214a24347605013cc7d5ededd103af67539434ef46e301340a9ff30ddcddc26e5eae58d931388cbf2c764874fc6cfcc11fae62e199f1f049553d8b1d021db2d39f550446ec721f360ae5df787f9d122560f6b9948416e0841390a1f619b15684e58dbab27fa327889073acc8cd480ab0a0d30e6cab75f2d4317b72b545d48a1888073a94b3b6c038bd51603c892aac2c8b35f6e522f30ae5ede07bc5de626f46e9bc13610e053fa83fbbb28693c944d2dd919e889c8d20348531760c4458970b2aa044bef5c9f4fb13f804213927f22168bfb6a626b62724da565702de30b6c9d97a28f175b30bfedae1c1405f54f9c2369d6b9790eb954a192d74a7f698d3ced8f18b0de09d9d31722a11716c231a7942bce8c3af1eb7d83d4e21283cd1e18d909149a0a9a472a69925539d8c0a9883723ff7792ecad08fbec504afcd5e9fd0055f34e9cf8abb2347c4d773924bad0736bd3731d744bb8a8ac234a03a63bd727a405a4bd3df301c7a2e3026a7556c3570fe2b3f9b2a75f04366838a", 0x0, 0x0) ioctl$SG_NEXT_CMD_LEN(r3, 0x2283, &(0x7f0000000040)=0xdf) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006326400000000000000000eadcf300000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 412.556796] binder: 11457:11459 unknown command 1522557696 [ 412.565907] binder: 11457:11459 ioctl c0306201 20000440 returned -22 [ 412.575963] device lo left promiscuous mode [ 412.577988] binder_alloc: binder_alloc_mmap_handler: 11457 20001000-20004000 already mapped failed -16 03:36:20 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:20 executing program 7: r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/backup_only\x00', 0x2, 0x0) ioctl$RTC_UIE_OFF(r0, 0x7004) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20010, r0, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) openat(r0, &(0x7f0000000080)='./file0\x00', 0x80000, 0x40) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) ioctl(r2, 0x73f, &(0x7f0000000480)="59f369d9166dbc575263ca806f296f75946c8f0a087d4849b7392f28111ad9f8bc5ea1d91c8e7b585f983863bf9ee032dcfbec5e4a8d57893557cddf0dc5e569bb6fa0a800db83b8235ffcb8f87b73306528f336344bb45d0d5665a1cc9e55a322a4c2eb8f4bc9929dd8adb48d3fa144e653e6fd501a21cadd36dc09ad581d2ec17f6d6e7bb560abea1e2b213ecba00b01ee759fc7083048e762391590f431b970c4c096c95b64dc99e6096e045f121b155a690e300699a6a46b882e762e5bf304f939d0e595dc3bbe6e8470410822ddc244bd6929c6ecbd5a3b2c7e0e33a0145643b410b3ffa94124892a2a079155a9b0e32b0491d5a403cbcd123a0fec5c516a29d434db1a78c86559695819563a40c367d3077647e0e769c3cfee9be86c2c5d571badc1e0ba966bdf75010a9fab6a415c08454cc228a0abfd2542fc431120295629b72fda4b1c8ee5242b7fddcb459ea53e2b642323479096f24866ffb23167960038f2bed67692ae90c95f3f1996fd6d78a11bacc6f7c2c4800320c3af9f6f25ef1172405d874e670517d114f6dafbcb2a44ab4766a0719831d41cef93b6d9d82c08bea000a629759d3674196580f676c751addb551501bd009d477bfd5b5071d775c34f6eddae7d9d6d965f1a5049e96cb59bddc83b2e225befd3c3df6426d5d6cfb44fb94411830f0d4eb99f252dad515deefcce4a78b6fcecb4861890de39e2bb91f32277800db2b87c227591acd89f22283836e7deacfa2dbc014e8a02199895d2fa7a29f37f134ce8898887bc92b4c35524d48df8bb6cde653f9c83976b0c1da9f039fbf0b06fa507bdc2a5aa4404cf8800a6d0b88082c38dcd152539077f5499217b75aa5a176171d674479df7a008b53a088eb0c2d6a2e33837d5f49e47943097052690fa283fa201f68c9a5c83399ec9ca93df1b4713ddb77eb2499c742b1f2eff89006e512a508f20f8dfcd0e605372fd0efc8f166ad5cabc8725b861579d776df2edae718edce8c0e3ae366e288fe41a4b148b874ac5b48edcd0b658e76bfb88b3595a4399bb74cee1529b759dd8e598a0a74b98a002807210eaed441bb853d867308225014bc7a12dea474812c22b99c7e3083b29e6d815798ae6a885b70574f455631c3c35dedf11cec083c15bbfb7d56520fd2280899edecb70a368c3fe65f91722e6736fbbe84c66c26f9df24ef304c902eb7e92640e2cce7e79e0ea00c80c2a22d99c19c70ed98c0d0ef69c7909e5397949b24add02d19fb9a562e970d1736e25c3e1418fa27832fce393565838b123b53d2482b3221fe3c413b213e9e559790347c6f1a8fc1c5887c8d84f43768f20f3b6b72902c1888fdf05011f2ae990bc8d5876a9ee60b9f49d5a7d03636e30b66db192518c872f099d47e069ed6c68b21aa2595fbc8e8aa8fafb032fd29cfa4b8b2e60884e2aa8b97ea3333dd88cc11545810db967006986b13ff2f60d68da24311f6c7d4922f19fc2bc0b62300848448076d28901295e63f79c44628040a316b053f0ff144205e7a58f38111503c958742d4bdb1fafcb8c1dce92649149deaf130e9af9884bc786487e019115c574117bba68a007f6ba046ea1a11820e8a7b8244f959e685110f324a2e1f016a3fc644cc6323cd265be64537dfa86bdfeca2fda032820dd123ae33e198d838f542861925b45e24458cc64e7949bb3baba9edafcc6d49407ce3524d7dc61f9cbb820ea3755288d9e495f7f2fe8ba3c27b99952932f3caee0c454583b318b15098afe2adfac53944818228b8dd7e5a934814b84fa2d8010dd6ed7261c261a312e5c9c689cb57ff0a9470a75c8dff7a53be688502caf57d776ef2622e809dc696400558996bffb543d2cd1280eea4cef7c7b1dd3ccca3c8717def915bbdf0740eb339afd5a4a0e64cef694a15c42681da9b6aa14f11530cc4e2f99b9d03887e53df97a60d4155a619bb6350ece5a412c2adda97d4da4a141b68080a1adf359a78c153d0bd56085747d7920d176e6fea0a8ec081c616e46bbdab1312f08bc40f9ebb615ec154e73e4092a78fd53dc0cdb77941d2a4d11edaaf070274bdec77e9c7cc6e4c0b398df9ca2e05a4233cd78db02b0f19a34ea9f058f70e8182491d12b0e9b27be167471cb5159f7513ccf88e34dbaadb468042e07b668fbe69f40ebcf8f8dfa4ecbc01e290dfac65feff4755da8be7c8f1f54df81b131d6ea7ac9fe228fcca316a8a259463830e3c37c660c40d794b7c33b281187db6c366f70ee54395ce42e3776252af816a186f410be0ed9dce57f262cbad25d8f76af13458f8040aa6bccef96ffce98ccb7b64bf8c22f944d171eab7f4092a3848d55f8cbd9bd7235722129f3202da36b15e3783df256d9e7302cee5ec66099b68360c561aff814a471457d4aad4a656aa63d4efe9a20d242c96629fbb048fb2fd0b1c17b546d22a1eca698e5b5b1f5a0ab7596ec7fe09e84247e0810483648edb3d37fe514be8f7efe143d616626726b4ed43c961f188f29d8cb02c23e944fdd8b3d366bc9531838761c4010ade6736082cce37a3af3a5892e67f615a05525f7431e9e3c50ee4016c9a9b4e447e17dcb10b106d2350626db281f3646e5513a0a8d881ff5077b15cad6bf96708ebc59a0fef8c346569888bba7692864f6360767eec8a21a2bf03d36784d1cdbabab7ca49aec78f23d35bb2733bbf99fedd74587f3da9e54d52b9395a3a0b46a7b95d0d055b564e217c939ee5246eef430a84581642a9e574532410d822d86386d2b2f904b25bc08c9cda2ca4e8536927a799995045f0d8685805ecbbc2a3a3e5612e3b165de7f1cbd8198ff4a69f33d87f76875214c238945266db4c22f546995bcb4c10e844a66e4b4667b871b76aca72101239c7eddf8d61804463fc5e05035229d795588901277a5cbac55a06951fe57d6e388ceababf9d7706b6eee1b8ff53cf7065186526cb52bf1f00863dd9e844d71edb429d698a46015c202e735abb7b0a29302dec4ee7eebc9d0788b289a9e9672c19ce4970331252815b5f635e9831f43012e4eb797908998fcb2086d70bb2d5cad7b846642f15fc488ca49649cf8330f756bb65605611503284c67dcdd7b03713d06c525533751251e1c89bc131e29bee607593b5d661f0e268da859410bcabaa63f5e6b4c8809770d973e1c35611246504b4f58d0b61ace76ea67a97bd0fa9670075daa59d92fb60b21745d146b2a627e59998a15df1f0e9de0b08e1aca2f733822d3e5f95ff858d8c0056523f70d8ca760eb7d7819a95bceac68c1919831526e2a1704e4809a46b752ee861f03f3f781591eba2a8b985c94ea77ff64c53d2aabd9d16b662a44aaf00545c543c5f7b9c0c2f0c0f5b0338aed8d05aa743f068d2ed0384a8e4296233fecb99bd58012f6f58e7f5fd2f6d7af567dab0cd53fa8178620cc8a0786d19f61a567edb45239f86d5f81579c48183aeda7018f49ed323e9dfe8bac5e8077e0dae8e3d76a99d4a36f35c90b7bebbf0ccd8745eeb3492691adaeaa74664da4558774a98405ed876f5592b851a8814430aac990de090ca79a392aeaa42dfb4aaf72169fd22510a0cbec256b40c123121e09520f688dbcb0acc7a9f8f1d047202d90cb66e8fb45f9bfbf5ddedcaec601c2a75df798df9d90a390066e7202f8777517f8e7a617a37ce3b74daa33c26519999121462c0d166c6919ce7da70051f94c1ec43ee095217afe382f24374f1b91c0310b7bf26c65c61a553fa0e9970eb479c9b36e55e097dd80e3b7604bc2330d4379e0550b992d57f67ec3392a59aa67431d45983a011137ae690c72383f3277c1a7c582057202c427ac973519fbfd5dda3dd5dcac46fa90c6407cc37a2a4a4a475965107e76010c963f54cdcd3da114d5c2c4bc2f71d38d27bffb664205f0e5a00890e11a3f324935ead9f9fa430746ccfbf32e2cd63d1c1c05f081ef0543ff72fcd9f27c4d2882ded2b14bbe771348313b930e2387b77b97b420e45558ef5647ba3925a8f4c6009fff1ec82a64b83d0f59e67a2dfaf2e4e1eee05e3e281cc6ed5f7fa26377123aeceb14f7030cf11c25ba057e5b973878eac2b25992872060972cce5359abc494b2200c151d974774698137709fe97af26d7a40bc1803406982263174ffee11e94cabfabc45cc5c7ac4966767740e8d25d94f9c7e64b6f106fc2e9445fc003e3ce2883a78d96384dc67c7ed8ac6cb69bb84e99d582bc92e874b67427f51ec4d87bf9678c651bcc16e89331201e6fe88f70224bfb39fc314506b526dd0926f19ea14488b866dc8d68f47466f7e966c792ab7946b3095425b423374fc83771a097cb91b919de0707d23d95bdfb15d1622ccf1139cbdc7aa361f16b88181c26dad4829465e954ba2fc45ddbb64bd2a957b355532b76f71aca9e9e7d9eac58339a18d1e0cd8848c3a72cc3804fe51c77418dd27115755b9271e0f2577ca6e0c1748e43f93baa429daa84ef16293b74f9ea484530fffe8c3e4980a1cc779cf503d791d8274e8b2bf117bb5817a0dd78ca36af5a099552d7eabe5f50ce5dc93748b7bf63ea8cd447eb6b03e24c06c75da1d7b3d7411ac72c8f5f5440e7242e0f72c918311c48a87ef3a7da850fed6985fe8c9cd6b76f7c48885c905e76a891d9b14567e76c55ee90d492b586eb1eba8d2a4a6c85321bbc4c5a04097370cc875f09830a0d74fca842c92a035800951a8c971aacfbc35de0bc82bbac47c3f6c5d275f23b90b45e069fb68bf0be1da75b0f295fad50724aca19a3b889c4d6d9d7efd5ddfb11f2e2bb1b278f276e4db07169bc156be930e8dc88acf39e5c912f77b9feff6f6afd95d16cccc6f504ab985edf5c393df9860780ffc1930ef082b873cac159e448471d82a4d7c21a8640341a6ca42215a0c62d327dadcd76915011c714f9ede56e0b590593a70c80aaf1264382bad0466b8f10260cc9f16476af314c6209eb22d5e8026ca090f6a5ec645e2e2ca711efffe5180a28a30a300ce8272d58771d1157966333d90e4008e9b4ed1fe2c283930ce1244c2a0fe50278602f6e8a910e088518e999528497da75f25968f405a54b58974a7f54e5a1aeb9dc288a29417f96a6635fb2fc78a9944f88f40535cb05625decaf9802d0fb82b5e4fab08200c7f0f1e93ab196970cbcfe3bceb33ea768797468b5fc1f40ebb26ebe15e7f30a53d0fd924ac6e3807f21340a9c35592c2bbe7094c9624c103ec8609cc3a475aa30bbc25f7f5c4b1f95e0dab6de8b2d1274bf4773ce149d6f76509814ec8c5e06bd03f67e5e75f614da8106e1453e4e5677c0568370b4a805980ee817a807050739144f972962c3a74ed08a9feab6364c523063d5e69eaaea21a86263f15331f438fa074e7043fb306e6257adc5afe79f16772afce94b1e975d90c7378e24689a71e78d89b57c379513c74e7f278d005244e559afd00628b1d8e8c1aa1058dbbd2de657914fc972fcc026ae9735be88a5ee565e05ef983b5908f81ae82acdc67b32fcceb3cb406ca586826dc49f87dacc6d5d330d95870baaa0803dbab31dccc1b165fe610108b5494443b2f3c8928f0db75fa44b72f7499f3cc6f53ad07ebb4b57bc72deab5918c800fce617f7c2ddd557813e1d2988fff3a95ac7b48ebe60fb1d96b23a3ee94c2c86d4ae5886564873629634ef4ad712e9b327223658ff3d4db5d2bdfc54dd716f0a9cba707677633e35329a4728292456b64f633313a5779030aa7781588b666d04b7e8a67e5df75419e9b03470fdf1b8b6ffb27974da99c574847274028ce") ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000040)) [ 412.578095] binder: BINDER_SET_CONTEXT_MGR already set [ 412.578102] binder: 11457:11469 ioctl 40046207 0 returned -16 [ 412.591617] binder: 11458:11467 ioctl c0306201 20000440 returned -14 03:36:20 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 412.606623] binder_alloc: 11470: binder_alloc_buf failed to map page at 20001000 in userspace [ 412.606662] binder: 11470:11474 transaction failed 29201/-12, size 0-0 line 3136 [ 412.607591] binder: BINDER_SET_CONTEXT_MGR already set [ 412.607600] binder: 11470:11474 ioctl 40046207 0 returned -16 [ 412.607643] binder_alloc: 11470: binder_alloc_buf, no vma [ 412.607659] binder: 11470:11475 transaction failed 29189/-3, size 0-0 line 3136 [ 412.608004] binder: undelivered TRANSACTION_ERROR: 29189 [ 412.608080] binder: undelivered TRANSACTION_ERROR: 29201 [ 412.633413] binder: 11477:11483 ioctl c0306201 20000440 returned -14 [ 412.645098] binder: 11482:11484 BC_DEAD_BINDER_DONE 0000000000000002 not found [ 412.645213] binder: 11482:11484 got transaction to invalid handle [ 412.645222] binder: 11482:11484 transaction failed 29201/-22, size 24-8 line 3013 [ 412.648759] binder: 11482:11484 unknown command 1076257536 [ 412.648768] binder: 11482:11484 ioctl c0306201 20000440 returned -22 [ 412.649294] binder: 11482:11484 BC_DEAD_BINDER_DONE 0000000000000002 not found [ 412.649303] binder: 11482:11484 got transaction to invalid handle [ 412.649310] binder: 11482:11484 transaction failed 29201/-22, size 24-8 line 3013 [ 412.650002] binder: BINDER_SET_CONTEXT_MGR already set [ 412.650010] binder: 11482:11487 ioctl 40046207 0 returned -16 [ 412.671336] binder: 11488:11489 ioctl c0306201 20000440 returned -14 [ 412.706638] binder: 11494:11498 ioctl 54a2 0 returned -22 [ 412.707070] binder: 11494:11498 ioctl 73f 20000480 returned -22 [ 412.707158] binder_alloc: 11494: binder_alloc_buf, no vma [ 412.707177] binder: 11494:11498 transaction failed 29189/-3, size 0-0 line 3136 [ 412.711751] binder: 11499:11501 ioctl c0306201 20000440 returned -14 [ 412.721717] binder: BINDER_SET_CONTEXT_MGR already set [ 412.721726] binder: 11494:11502 ioctl 40046207 0 returned -16 [ 412.721893] binder: 11494:11502 ioctl 54a2 0 returned -22 [ 412.721979] binder: 11494:11498 ioctl 73f 20000480 returned -22 [ 412.722020] binder_alloc: 11494: binder_alloc_buf, no vma [ 412.722036] binder: 11494:11502 transaction failed 29189/-3, size 0-0 line 3136 [ 412.722441] binder: undelivered TRANSACTION_ERROR: 29189 [ 412.722485] binder: undelivered TRANSACTION_ERROR: 29189 [ 413.012946] device lo left promiscuous mode [ 413.020621] device lo entered promiscuous mode [ 413.030728] device lo left promiscuous mode [ 413.081543] device lo entered promiscuous mode 03:36:21 executing program 1: r0 = dup2(0xffffffffffffff9c, 0xffffffffffffffff) write$P9_RREADLINK(r0, &(0x7f0000000000)={0x10, 0x17, 0x1, {0x7, './file0'}}, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) 03:36:21 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b02a", 0xb) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:21 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fab687c7d3ccd1ed5b49e25a5b745ecc139c8968b51e2ad08080d904a0e3fedf2fff55051a7fee29d232a28e8d4e2661ca6f80ba38516728713b723620d1a0d48e065ee66e7fe2feb7de1e3fea45dc2f40e6f6ff3337c5fe9300649c0bda5992276be2a145ab6d1e0c879d395c6496a68ceb02ffca097968677cd65d97481ff68364e2a37eee582c44089609c4450287fb63e67920ae731be6bb22b590c3677875ea0e", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:21 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x10000000003, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = userfaultfd(0x80000) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000fff000/0x1000)=nil, 0x1000}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:21 executing program 4: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000240)='/dev/autofs\x00', 0x200, 0x0) ioctl$LOOP_SET_STATUS(r0, 0x4c02, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x3f, 0x0, 0xfffffffffffffffc, 0x1, "0fac895cc459982d99764538cb43ac533b0b9da42670bd4976d90ee17e6d77c8f82f25dd0df52b43ec336c6f82542a6be8f84444b7c42d5cd1ebd2a712f3c849", "9cb130834eea16f3f55e08726d9aa07376b66d8675d52ae643c410f6a2f88f40", [0x2, 0xff]}) open(&(0x7f0000000140)='./file0\x00', 0x400, 0x40) r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = add_key(&(0x7f0000000340)='dns_resolver\x00', &(0x7f0000000380)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000003c0), 0x0, 0xfffffffffffffffb) keyctl$get_keyring_id(0x0, r3, 0xd1b7) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$LOOP_GET_STATUS(r1, 0x4c03, &(0x7f0000000000)) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) r4 = fcntl$getown(r1, 0x9) fcntl$setownex(r2, 0xf, &(0x7f00000001c0)={0x2, r4}) 03:36:21 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:21 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = signalfd4(r1, &(0x7f00000002c0)={0x80}, 0x8, 0x80800) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) pipe2(&(0x7f0000000200)={0xffffffffffffffff}, 0x80000) ioctl$EVIOCSCLOCKID(r4, 0x400445a0, &(0x7f0000000280)=0x6) r5 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000680)='/dev/hwrng\x00', 0x0, 0x0) ioctl$PERF_EVENT_IOC_SET_FILTER(r7, 0x40082406, &(0x7f0000000180)='/dev/loop#\x00') open(&(0x7f0000000300)='./file0\x00', 0x2, 0x2) sendmsg$nl_route(r5, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="13001900879a975635fd34cb00dc0021950008001b000045ad033d47296b02485219c179bd9f2fb4dd26cfc64e492a995ea5741f318b04a7523ff4b4454c94"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) write$FUSE_BMAP(r6, &(0x7f0000000400)={0x18, 0x0, 0x7, {0x100000001}}, 0x18) r8 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000000440)={0x0, @loopback, @rand_addr}, &(0x7f0000000480)=0xc) sendmsg$nl_route(r5, &(0x7f0000000580)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000540)={&(0x7f00000004c0)=@setneightbl={0x68, 0x43, 0x0, 0x70bd2b, 0x25dfdbfd, {0x2}, [@NDTA_GC_INTERVAL={0xc, 0x8, 0x5}, @NDTA_NAME={0xc, 0x1, ')ppp1\x00'}, @NDTA_GC_INTERVAL={0xc, 0x8, 0x2}, @NDTA_PARMS={0x30, 0x6, [@NDTPA_IFINDEX={0x8, 0x1, r9}, @NDTPA_BASE_REACHABLE_TIME={0xc, 0x4, 0x4}, @NDTPA_LOCKTIME={0xc, 0xf, 0x101}, @NDTPA_GC_STALETIME={0xc, 0x6, 0x5}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x4000810}, 0x85) ioctl$LOOP_SET_FD(r0, 0x4c00, r8) ioctl$LOOP_CHANGE_FD(r6, 0x4c06, r2) [ 413.187033] binder_alloc: 11515: binder_alloc_buf failed to map page at 20001000 in userspace [ 413.194959] device lo entered promiscuous mode [ 413.205617] device lo left promiscuous mode [ 413.209863] binder: 11513:11516 ioctl c0306201 20000440 returned -14 [ 413.230763] binder: 11515:11518 transaction failed 29201/-12, size 0-0 line 3136 [ 413.251523] binder_alloc: binder_alloc_mmap_handler: 11515 20001000-20004000 already mapped failed -16 [ 413.261697] binder: BINDER_SET_CONTEXT_MGR already set [ 413.269485] binder: 11515:11525 ioctl 40046207 0 returned -16 [ 413.276596] binder: undelivered TRANSACTION_ERROR: 29201 03:36:21 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000"], 0x87) 03:36:21 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:21 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) open(&(0x7f0000000000)='./file0\x00', 0x100, 0x80) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:21 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) bind(r0, &(0x7f0000000100)=@in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x10}}, 0x80) sendto(r0, &(0x7f0000000000)="311d1e57f1f5dcba138d2804401390811d236968972233508ac4e1d84ddb0052d1cd489bbeb548b789b2b43e4609ecd4d294c32530abe6cc", 0x38, 0x40000, &(0x7f0000000040)=@ethernet={0x306, @remote}, 0x80) 03:36:21 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vga_arbiter\x00', 0xa0002, 0x0) getsockopt$EBT_SO_GET_INIT_ENTRIES(r2, 0x0, 0x83, &(0x7f0000000140)={'filter\x00', 0x0, 0x1, 0x37, [], 0x1, &(0x7f0000000040)=[{}], &(0x7f0000000080)=""/55}, &(0x7f00000000c0)=0x78) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000f1ff000000000000000000000000000000000000000000000000595f00000000000000000000000000871b0a1d0000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 413.348089] device lo entered promiscuous mode [ 413.353994] device lo left promiscuous mode [ 413.377250] device lo entered promiscuous mode 03:36:21 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:21 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 413.386866] binder_alloc: 11539: binder_alloc_buf, no vma [ 413.386885] binder: 11539:11541 transaction failed 29189/-3, size 0-0 line 3136 [ 413.387421] binder: BINDER_SET_CONTEXT_MGR already set 03:36:21 executing program 7: r0 = syz_open_dev$usbmon(&(0x7f0000000380)='/dev/usbmon#\x00', 0x200, 0x6102) getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1f, &(0x7f0000002480)={@loopback, 0x0}, &(0x7f00000024c0)=0x14) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000002500)={'veth0_to_bridge\x00', r1}) syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r0, 0x40505330, &(0x7f0000000500)={{0x9, 0x2}, {0xe4ac, 0x800000002}, 0xfffffffffffffffa, 0x3, 0x4}) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000440)={0xfffffffffffffedc, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYRESOCT=r0], 0x0, 0x0, &(0x7f00000003c0)}) readv(r2, &(0x7f0000000480)=[{&(0x7f0000000140)=""/146, 0x92}, {&(0x7f0000000200)=""/162, 0xa2}, {&(0x7f0000000000)=""/70, 0x46}, {&(0x7f00000002c0)=""/116, 0x74}, {&(0x7f00000003c0)=""/106, 0x6a}, {&(0x7f0000000340)=""/33, 0x21}], 0x6) [ 413.387430] binder: 11539:11542 ioctl 40046207 0 returned -16 [ 413.387804] binder: undelivered TRANSACTION_ERROR: 29189 [ 413.415899] binder: 11537:11538 ioctl c0306201 20000440 returned -14 [ 413.451181] binder: 11546:11552 got transaction to invalid handle 03:36:21 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:21 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f79", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 413.451190] binder: 11546:11552 transaction failed 29201/-22, size 0-31929248710656 line 3013 [ 413.461001] binder_alloc: binder_alloc_mmap_handler: 11546 20001000-20004000 already mapped failed -16 [ 413.461244] binder: BINDER_SET_CONTEXT_MGR already set [ 413.461253] binder: 11546:11557 ioctl 40046207 0 returned -16 03:36:21 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) r2 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) setsockopt$inet6_opts(r2, 0x29, 0x3f, &(0x7f0000000140)=@srh={0x5e, 0x6, 0x4, 0x3, 0x800, 0x0, 0x27, [@local, @mcast1, @loopback]}, 0x38) setsockopt$IP_VS_SO_SET_DEL(r2, 0x0, 0x484, &(0x7f0000000040)={0x3a, @local, 0x4e22, 0x4, 'lblcr\x00', 0x12, 0x1, 0xb}, 0x2c) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x101000, 0x0) ioctl$KDGKBENT(r2, 0x4b46, &(0x7f0000000080)={0x17f, 0x80000000, 0x88fb}) 03:36:21 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) [ 413.461334] binder: 11546:11552 got transaction to invalid handle [ 413.461343] binder: 11546:11552 transaction failed 29201/-22, size 0-31929248710656 line 3013 [ 413.461439] binder: undelivered TRANSACTION_ERROR: 29201 [ 413.461658] binder: undelivered TRANSACTION_ERROR: 29201 [ 413.468528] binder: 11555:11558 ioctl c0306201 20000440 returned -14 [ 413.512590] binder: 11563:11566 ioctl c0306201 20000440 returned -14 [ 413.533963] binder: BINDER_SET_CONTEXT_MGR already set [ 413.533974] binder: 11562:11567 ioctl 40046207 0 returned -16 [ 413.576824] binder_alloc: 11574: binder_alloc_buf failed to map page at 20001000 in userspace [ 413.576854] binder: 11574:11575 transaction failed 29201/-12, size 0-0 line 3136 [ 413.583945] binder_alloc: binder_alloc_mmap_handler: 11574 20001000-20004000 already mapped failed -16 [ 413.584196] binder: BINDER_SET_CONTEXT_MGR already set [ 413.584204] binder: 11574:11575 ioctl 40046207 0 returned -16 [ 413.584244] binder_alloc: 11574: binder_alloc_buf, no vma [ 413.584259] binder: 11574:11576 transaction failed 29189/-3, size 0-0 line 3136 [ 413.584684] binder: undelivered TRANSACTION_ERROR: 29189 [ 413.584752] binder: undelivered TRANSACTION_ERROR: 29201 [ 413.595266] binder: 11568:11569 ioctl c0306201 20000440 returned -14 [ 413.690230] device lo left promiscuous mode 03:36:21 executing program 5: r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x1000000000000002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000040)='/dev/loop#\x00', 0x1, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={"6c6f0040000000000100", 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0x100}) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r0) pwritev(r1, &(0x7f0000000080)=[{&(0x7f0000000240)="9c72ecc2e37d53a4e588ccbda560fc5def94e4839783e702f621251c376af139b92d5b863744de52fc51df853577664eb2a7ed127c6dd402a2ed52f6d39dc504c74e49b983f55effbd0f376c8c7e4a63710a7ca9265d5cfed99f8903c127cf0789f0f2a0892c50e06766677b791517", 0x6f}], 0x1, 0x4) ioctl$EVIOCGBITKEY(0xffffffffffffffff, 0x80404521, &(0x7f00000001c0)=""/121) shutdown(0xffffffffffffffff, 0x7fffffffffffd) r3 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) 03:36:21 executing program 7: syz_open_dev$binder(&(0x7f0000000140)='/dev/binder#\x00', 0x0, 0x2) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r2 = dup2(r1, r1) getsockname$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @local}, &(0x7f0000000040)=0x1c) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000000000101c093000000000000000000000000100000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$RTC_EPOCH_READ(r2, 0x8008700d, &(0x7f0000000080)) ioctl$TCSETA(r2, 0x5406, &(0x7f00000000c0)={0x101, 0x1e, 0x7f, 0x0, 0x0, 0x9, 0x0, 0x5, 0x7}) [ 413.737911] device lo left promiscuous mode [ 413.762839] device lo entered promiscuous mode 03:36:21 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) [ 413.783943] binder: 11579:11583 got transaction to context manager from process owning it [ 413.800474] binder: 11579:11583 transaction failed 29201/-22, size 0-0 line 3004 [ 413.819101] binder: 11579:11583 ioctl 8008700d 20000080 returned -22 [ 413.833203] binder: 11579:11583 ioctl 5406 200000c0 returned -22 [ 413.853220] binder: BINDER_SET_CONTEXT_MGR already set [ 413.858865] binder: 11579:11583 ioctl 40046207 0 returned -16 [ 413.864302] binder_alloc: 11579: binder_alloc_buf, no vma [ 413.864326] binder: 11579:11588 transaction failed 29189/-3, size 0-0 line 3136 [ 413.864416] binder: 11579:11587 ioctl 8008700d 20000080 returned -22 [ 413.864447] binder: 11579:11588 ioctl 5406 200000c0 returned -22 [ 413.864884] binder: undelivered TRANSACTION_ERROR: 29201 [ 413.897266] binder: undelivered TRANSACTION_ERROR: 29189 03:36:21 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x200, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000200)={@local, 0x100000000, 0x2, 0x3, 0x0, 0xffffffff, 0x800, 0x3}, 0x20) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) vmsplice(r1, &(0x7f0000000400)=[{&(0x7f0000000280)="7854cc9955197164538ef8cec598d0fb6031375ca59a4df4084c42ea2ff1ddf46d0a4aafb03fc72fcf373a13a57a318836a65d07fdafc174622ee96ec67f0a1a659e80af4e7ef86ae6705f92943ac12c441f4bcd19733cceaadfe72c1d51eb178b80c3e797adb5626cfab0192462699a150da0c9cc98eaab3fca7692fc4c02746528b7dd273855b0530ee3ed19b59f1e5658077db935608d3ab0e85d50138f202e2e4aa9ed99d0dc84fbd982fa1079b2bff28b1c73d6693c1967e174e64c11c20e38ed7058aeb464", 0xc8}, {&(0x7f0000000380)}], 0x2, 0x6) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f0000000380)={0x2, 0x9, 0x7, 0x1, 0x4}) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:36:22 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000"], 0x87) 03:36:22 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f79", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:22 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x4000, 0x0) connect$l2tp(r1, &(0x7f0000000040)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x4e22, @local}, 0x2, 0x4, 0x0, 0x3}}, 0x2e) 03:36:22 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x80000, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x88200232}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="1c0000001a0004002cbd7000fddb03000000020000"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4c040) bind$inet(r1, &(0x7f0000000180)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x17}}, 0x10) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:22 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:22 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) utime(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x80, 0x3}) [ 414.214555] device lo entered promiscuous mode 03:36:22 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000271c322100000000f1ff0000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0xffffffffffffffa3, 0x0, &(0x7f00000003c0)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) 03:36:22 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="03000000000002000800130000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) [ 414.244683] binder: 11601:11608 ioctl c0306201 20000440 returned -14 [ 414.251272] device lo left promiscuous mode [ 414.251699] binder: BINDER_SET_CONTEXT_MGR already set 03:36:22 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@ipv4={[], [], @dev}, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@remote}, 0x0, @in=@remote}}, &(0x7f0000000280)=0xe8) r3 = getegid() chown(&(0x7f0000000140)='./file0\x00', r2, r3) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r4 = memfd_create(&(0x7f0000000040)="9a2140766d6e657430766d6e6574312c2800", 0x1) getpeername$inet6(r4, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2}, &(0x7f00000000c0)=0x1c) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) mkdir(&(0x7f0000000000)='./file0\x00', 0xb8) 03:36:22 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 414.251709] binder: 11604:11607 ioctl 40046207 0 returned -16 [ 414.253885] device lo entered promiscuous mode [ 414.264380] device lo left promiscuous mode [ 414.288396] binder_alloc: 11613: binder_alloc_buf failed to map page at 20001000 in userspace 03:36:22 executing program 7: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x20211, r0, 0x0) r1 = dup(r0) ioctl$TUNSETPERSIST(r1, 0x400454cb, 0x1) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) [ 414.288427] binder: 11613:11618 transaction failed 29201/-12, size 0-0 line 3136 [ 414.301824] binder_alloc: binder_alloc_mmap_handler: 11613 20001000-20004000 already mapped failed -16 [ 414.302883] binder: BINDER_SET_CONTEXT_MGR already set [ 414.302891] binder: 11613:11620 ioctl 40046207 0 returned -16 [ 414.302985] binder_alloc: 11613: binder_alloc_buf, no vma [ 414.303002] binder: 11613:11618 transaction failed 29189/-3, size 0-0 line 3136 [ 414.350487] binder_alloc: 11624: binder_alloc_buf failed to map page at 20001000 in userspace [ 414.355944] binder: 11624:11626 transaction failed 29201/-12, size 0-0 line 3136 [ 414.374529] binder: BINDER_SET_CONTEXT_MGR already set [ 414.374538] binder: 11624:11626 ioctl 40046207 0 returned -16 03:36:22 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000d56aeae61d5308580000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:22 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer2\x00', 0x28040, 0x0) ioctl$SG_GET_NUM_WAITING(r1, 0x227d, &(0x7f0000000040)) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:22 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) fcntl$dupfd(r1, 0x406, r0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0xfffffffffffffd2c, 0x0, &(0x7f0000000000)=[@acquire={0x40046305, 0x1}], 0xfffffffffffffd14, 0x0, &(0x7f00000000c0)="2696d194aa8dff26145214fbe8eb4cde21dce5"}) [ 414.374541] binder_alloc: 11624: binder_alloc_buf, no vma [ 414.374559] binder: 11624:11628 transaction failed 29189/-3, size 0-0 line 3136 [ 414.374963] binder: undelivered TRANSACTION_ERROR: 29189 [ 414.375027] binder: undelivered TRANSACTION_ERROR: 29201 [ 414.406089] binder: BINDER_SET_CONTEXT_MGR already set [ 414.406098] binder: 11631:11633 ioctl 40046207 0 returned -16 [ 414.460068] binder: 11636:11638 ioctl 400454cb 1 returned -22 [ 414.482448] binder_alloc: binder_alloc_mmap_handler: 11636 20004000-20008000 already mapped failed -16 [ 414.482952] binder: 11636:11640 ioctl 400454cb 1 returned -22 [ 414.483071] binder: BINDER_SET_CONTEXT_MGR already set [ 414.483079] binder: 11636:11639 ioctl 40046207 0 returned -16 [ 414.534293] binder_alloc: 11642: binder_alloc_buf size 378096786920 failed, no address space [ 414.534300] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 414.534327] binder: 11642:11643 transaction failed 29201/-28, size 378096786918-0 line 3136 [ 414.537569] binder_alloc: binder_alloc_mmap_handler: 11642 20001000-20004000 already mapped failed -16 [ 414.537695] binder: BINDER_SET_CONTEXT_MGR already set [ 414.537702] binder: 11642:11644 ioctl 40046207 0 returned -16 [ 414.538284] binder: undelivered TRANSACTION_ERROR: 29201 [ 414.538329] device lo left promiscuous mode [ 414.548032] device lo entered promiscuous mode [ 414.565206] device lo left promiscuous mode [ 414.653386] device lo entered promiscuous mode [ 414.660226] device lo left promiscuous mode [ 414.667236] device lo entered promiscuous mode [ 414.671996] device lo left promiscuous mode [ 415.366066] binder: BINDER_SET_CONTEXT_MGR already set [ 415.371407] binder: 11649:11660 ioctl 40046207 0 returned -16 [ 415.518947] IPVS: Creating netns size=2536 id=97 [ 415.552664] IPVS: Creating netns size=2536 id=98 [ 415.816323] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 415.834875] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 415.881698] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 415.900906] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 415.927822] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 415.946384] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 415.995008] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 416.028205] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 416.067042] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 416.089180] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 416.107680] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 416.115629] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 416.123166] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 416.141618] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 416.148566] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 416.160297] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 416.169531] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 416.188131] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 416.208202] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 416.227264] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 417.266527] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 417.321037] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 417.327314] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 417.334097] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 417.376982] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 417.431905] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 417.438100] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 417.444776] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:36:26 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:26 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000140)={'ip6_vti0\x00', 0x101}) ioctl$TIOCGPGRP(0xffffffffffffff9c, 0x540f, &(0x7f0000000040)=0x0) ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f0000000080)=r1) r2 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) write$P9_RLERROR(r2, &(0x7f0000000000)={0x14, 0x7, 0x2, {0xb, '/dev/loop#\x00'}}, 0x14) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:26 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0xb403}) 03:36:26 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f79", 0x6) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:26 executing program 3: r0 = add_key$keyring(&(0x7f00000003c0)='keyring\x00', &(0x7f0000000480)={0x73, 0x79, 0x7a, 0x1}, 0x0, 0x0, 0xfffffffffffffffb) r1 = request_key(&(0x7f0000000500)='.request_key_auth\x00', &(0x7f0000000540)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000580)='!&vboxnet1posix_acl_accesssecurity@&bdevuser\x00', 0xfffffffffffffffb) keyctl$reject(0x13, r0, 0x2, 0x9, r1) r2 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r3 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r4 = request_key(&(0x7f0000000180)='pkcs7_test\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, &(0x7f0000000380)='/dev/net/tun\x00', 0xffffffffffffffff) r5 = add_key(&(0x7f0000000400)='asymmetric\x00', &(0x7f0000000440)={0x73, 0x79, 0x7a, 0x0}, 0x0, 0x0, 0xfffffffffffffff9) keyctl$reject(0x13, r4, 0x5df8, 0x4, r5) lremovexattr(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)=@known='trusted.syz\x00') r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r7 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r8 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000200)='/selinux/enforce\x00', 0x8000, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r8, 0x29, 0x23, &(0x7f00000005c0)={{{@in6=@local, @in=@multicast2}}, {{@in6=@local}, 0x0, @in=@remote}}, &(0x7f00000006c0)=0xe8) r9 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000004c0)='/dev/hwrng\x00', 0x101005, 0x0) ioctl$EVIOCGPROP(r8, 0x80404509, &(0x7f0000000700)=""/227) sendmsg$nl_route(r7, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="355314af699908001b0080000002303fc08bf3e94907506bfb6553000000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r2, 0x4c00, r2) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r3) accept$inet(r9, &(0x7f0000000800)={0x2, 0x0, @remote}, &(0x7f0000000840)=0x10) 03:36:26 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f00040000000000000000"], 0x8c) [ 418.578404] device lo entered promiscuous mode [ 418.591866] device lo left promiscuous mode [ 418.602155] device lo entered promiscuous mode [ 418.618789] device lo left promiscuous mode 03:36:26 executing program 4: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x200, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000200)={@local, 0x100000000, 0x2, 0x3, 0x0, 0xffffffff, 0x800, 0x3}, 0x20) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) vmsplice(r1, &(0x7f0000000400)=[{&(0x7f0000000280)="7854cc9955197164538ef8cec598d0fb6031375ca59a4df4084c42ea2ff1ddf46d0a4aafb03fc72fcf373a13a57a318836a65d07fdafc174622ee96ec67f0a1a659e80af4e7ef86ae6705f92943ac12c441f4bcd19733cceaadfe72c1d51eb178b80c3e797adb5626cfab0192462699a150da0c9cc98eaab3fca7692fc4c02746528b7dd273855b0530ee3ed19b59f1e5658077db935608d3ab0e85d50138f202e2e4aa9ed99d0dc84fbd982fa1079b2bff28b1c73d6693c1967e174e64c11c20e38ed7058aeb464", 0xc8}, {&(0x7f0000000380)}], 0x2, 0x6) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f0000000380)={0x2, 0x9, 0x7, 0x1, 0x4}) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:36:26 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_proto_private(r2, 0x89e5, &(0x7f0000000040)="0f461268a6301832a9abf947e468c8e8bb67bbf2c20d34da8bfb96554d5b5f3af3ecff7652199147c8d70eccfeed5a2c7e7c613121ce5eee5fbefcc07a91ff26f5fa4daf6705046f6bb1097955023a23d42cd126eac83ae4b606efe0482b0ab9c04213539ba77b5636f1d4b96d3734e272c83627d10cda6b7ac801d545215d2d325805cd17cb7928a31312") 03:36:26 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0", 0x9) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:26 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) stat(&(0x7f0000000100)='./file0\x00', &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r2 = request_key(&(0x7f0000000340)='ceph\x00', &(0x7f0000000300)={0x73, 0x79, 0x7a, 0x2}, &(0x7f00000002c0)='@{\x00', 0xfffffffffffffffc) keyctl$get_persistent(0x16, r1, r2) clock_getres(0x3, &(0x7f0000000000)) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) fstat(r0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) setuid(r3) 03:36:26 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000140)='\x00', 0x3) ioctl$RTC_ALM_READ(r0, 0x80247008, &(0x7f0000000240)) write$P9_RCLUNK(r0, &(0x7f00000001c0)={0x7, 0x79, 0x2}, 0x7) socketpair(0x4, 0x1, 0x6c787f84, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$inet_tcp_int(r1, 0x6, 0x16, &(0x7f0000000040)=0x9, 0x4) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x200}) set_tid_address(&(0x7f0000000080)) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) fstatfs(r2, &(0x7f0000000540)=""/4096) [ 418.622374] binder: 12414:12417 ioctl c0306201 20000440 returned -14 03:36:26 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = accept(0xffffffffffffffff, &(0x7f0000000000)=@un=@abs, &(0x7f0000000080)=0x80) getsockopt$ARPT_SO_GET_INFO(r2, 0x0, 0x60, &(0x7f0000000140)={'filter\x00'}, &(0x7f00000000c0)=0x44) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00630500000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:26 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) socket$packet(0x11, 0x3, 0x300) r3 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r3) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) [ 418.679679] device lo entered promiscuous mode [ 418.683860] binder_alloc: 12433: binder_alloc_buf failed to map page at 20001000 in userspace 03:36:26 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0", 0x9) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:26 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xfffffffffffffffe) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 418.684349] binder: 12433:12439 transaction failed 29201/-12, size 0-0 line 3136 [ 418.685857] binder_alloc: binder_alloc_mmap_handler: 12433 20001000-20004000 already mapped failed -16 03:36:26 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0", 0x9) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 418.686063] binder: BINDER_SET_CONTEXT_MGR already set [ 418.686070] binder: 12433:12440 ioctl 40046207 0 returned -16 [ 418.686184] binder_alloc: 12433: binder_alloc_buf, no vma [ 418.686200] binder: 12433:12439 transaction failed 29189/-3, size 0-0 line 3136 [ 418.686636] binder: undelivered TRANSACTION_ERROR: 29189 [ 418.686691] binder: undelivered TRANSACTION_ERROR: 29201 [ 418.714279] binder: 12432:12436 ioctl c0306201 20000440 returned -14 [ 418.717347] binder: 12443:12445 unknown command 353024 [ 418.717355] binder: 12443:12445 ioctl c0306201 20000440 returned -22 [ 418.718095] binder_alloc: binder_alloc_mmap_handler: 12443 20001000-20004000 already mapped failed -16 [ 418.718186] binder: BINDER_SET_CONTEXT_MGR already set [ 418.718193] binder: 12443:12446 ioctl 40046207 0 returned -16 [ 418.771674] binder: 12451:12453 ioctl c0306201 20000440 returned -14 [ 418.790323] binder_alloc: binder_alloc_mmap_handler: 12450 20001000-20004000 already mapped failed -16 [ 418.790411] binder: BINDER_SET_CONTEXT_MGR already set [ 418.790417] binder: 12450:12458 ioctl 40046207 0 returned -16 [ 418.790710] binder: send failed reply for transaction 199 to 12450:12457 [ 418.790771] binder: undelivered TRANSACTION_COMPLETE [ 418.790777] binder: undelivered TRANSACTION_ERROR: 29189 03:36:26 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:26 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:26 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000080)='/dev/full\x00', 0x0, 0x0) setsockopt$inet6_mtu(r2, 0x29, 0x17, &(0x7f0000000180)=0x5, 0x4) ioctl$UFFDIO_ZEROPAGE(r2, 0xc020aa04, &(0x7f00000000c0)={{&(0x7f0000002000/0x1000)=nil, 0x1000}, 0x1}) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) mmap$binder(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x2000000, 0x10030, r0, 0x0) poll(&(0x7f0000000140)=[{r1, 0x100}, {r2, 0x401}], 0x2, 0x9) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0063404000000000000000000000000000000000000000000000000000000000000000000005ac43e50000000000000000002fad3c6ddcb485c7ed17718d0000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:26 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) open(&(0x7f0000000000)='./file0\x00', 0x80000, 0x22) [ 418.822308] binder: 12459:12461 ioctl c0306201 20000440 returned -14 [ 418.931984] device lo left promiscuous mode [ 418.956041] device lo entered promiscuous mode [ 418.962648] device lo left promiscuous mode 03:36:26 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) [ 418.999024] binder_alloc: 12474: binder_alloc_buf size -5967549996559760128 failed, no address space [ 419.012266] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 419.021208] device lo entered promiscuous mode [ 419.030189] device lo left promiscuous mode [ 419.033647] device lo entered promiscuous mode [ 419.036651] device lo left promiscuous mode [ 419.070148] binder: 12475:12483 ioctl c0306201 20000440 returned -14 [ 419.118989] binder: 12474:12477 transaction failed 29201/-28, size 984682857728--5967550981242617856 line 3136 [ 419.136639] binder_alloc: binder_alloc_mmap_handler: 12474 20001000-20004000 already mapped failed -16 [ 419.146553] device lo entered promiscuous mode [ 419.151639] binder: BINDER_SET_CONTEXT_MGR already set [ 419.157232] binder: 12474:12477 ioctl 40046207 0 returned -16 [ 419.157243] device lo left promiscuous mode [ 419.168660] binder_alloc: 12474: binder_alloc_buf, no vma [ 419.174288] binder: 12474:12490 transaction failed 29189/-3, size 984682857728--5967550981242617856 line 3136 [ 419.232022] device lo entered promiscuous mode [ 419.235281] binder: undelivered TRANSACTION_ERROR: 29189 [ 419.243403] device lo left promiscuous mode [ 419.275586] binder: undelivered TRANSACTION_ERROR: 29201 03:36:27 executing program 4: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x200, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000200)={@local, 0x100000000, 0x2, 0x3, 0x0, 0xffffffff, 0x800, 0x3}, 0x20) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) vmsplice(r1, &(0x7f0000000400)=[{&(0x7f0000000280)="7854cc9955197164538ef8cec598d0fb6031375ca59a4df4084c42ea2ff1ddf46d0a4aafb03fc72fcf373a13a57a318836a65d07fdafc174622ee96ec67f0a1a659e80af4e7ef86ae6705f92943ac12c441f4bcd19733cceaadfe72c1d51eb178b80c3e797adb5626cfab0192462699a150da0c9cc98eaab3fca7692fc4c02746528b7dd273855b0530ee3ed19b59f1e5658077db935608d3ab0e85d50138f202e2e4aa9ed99d0dc84fbd982fa1079b2bff28b1c73d6693c1967e174e64c11c20e38ed7058aeb464", 0xc8}, {&(0x7f0000000380)}], 0x2, 0x6) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f0000000380)={0x2, 0x9, 0x7, 0x1, 0x4}) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:36:27 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f00040000000000000000"], 0x8c) 03:36:27 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f00000000c0)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x60, 0x0, &(0x7f0000000140)=[@transaction={0x40406300, {0x3, 0x0, 0x4, 0x0, 0x10, 0x0, 0x0, 0x48, 0x28, &(0x7f0000000000)=[@fd={0x66642a85, 0x0, 0xffffffffffffffff, 0x0, 0x2}, @fd={0x66642a85, 0x0, 0xffffffffffffffff, 0x0, 0x2}, @fd={0x66642a85, 0x0, r0, 0x0, 0x4}], &(0x7f0000000080)=[0x20, 0x28, 0x28, 0x30, 0x78]}}, @release, @increfs_done={0x40106308, r1, 0x3}], 0xda, 0x0, &(0x7f00000001c0)="a8c1ad1a33a92171f0fa6243bee7a105df9da35ede55920dd22e32284d34b5219e1b49c37b86322bc608a4651446fe73e66d14387cf4bab128de120b9edb41b72447f2cd326dbc017009feadc4e10041e7fadbda991a01125978ff5fe5b054f6861341110b61ccdbff796f77fad7d48993915f4f17099aae8d6ab75cfefc9592063f6286788b6aecad50a8e087b641288f2b2980e2aafa6ef5b0ddb68e13e7d3fb2947d85fd021acda6af5bacba700ec70adc32366784abab51ff7f9991be254d34c17659b76b56f5adacc75fb6dd78e1c95397bab5f61f6d383"}) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) r2 = openat(0xffffffffffffffff, &(0x7f0000000100)='./file0\x00', 0x40, 0x1) ioctl$UI_ABS_SETUP(r2, 0x401c5504, &(0x7f0000000380)={0x8, {0x8001, 0x0, 0xa8a, 0x3, 0x9af, 0x400}}) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:27 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x4, 0x3) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r5) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) ioctl$GIO_FONTX(r4, 0x4b6b, &(0x7f0000000280)=""/157) 03:36:27 executing program 5: ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000040)={'bridge0\x00', &(0x7f0000000000)=@ethtool_ts_info={0x41, 0x0, 0x800, 0x101, [0x6, 0x10001, 0x4], 0x7ff, [0x3, 0x0, 0x7fff]}}) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = dup(0xffffffffffffffff) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000140)='team\x00') getsockopt$inet6_mreq(0xffffffffffffff9c, 0x29, 0x1b, &(0x7f00000001c0)={@mcast1, 0x0}, &(0x7f00000002c0)=0x14) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000440)={0x0, @multicast1, @multicast1}, &(0x7f0000000480)=0xc) accept4(0xffffffffffffffff, &(0x7f00000004c0)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000540)=0x80, 0x800) getsockname$packet(0xffffffffffffff9c, &(0x7f0000000580)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f00000005c0)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000021c0)={'team0\x00', 0x0}) recvmmsg(0xffffffffffffffff, &(0x7f0000003ec0)=[{{&(0x7f0000002280)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000002340)=[{&(0x7f0000002300)=""/46, 0x2e}], 0x1, &(0x7f0000002380)=""/144, 0x90, 0x8}, 0x81}, {{0x0, 0x0, &(0x7f0000002540)=[{&(0x7f0000002440)=""/200, 0xc8}], 0x1, &(0x7f0000002580)=""/5, 0x5, 0x6}, 0x80000001}, {{&(0x7f00000025c0)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002b40)=[{&(0x7f0000002640)=""/187, 0xbb}, {&(0x7f0000002700)=""/106, 0x6a}, {&(0x7f0000002780)=""/247, 0xf7}, {&(0x7f0000002880)=""/154, 0x9a}, {&(0x7f0000002940)=""/170, 0xaa}, {&(0x7f0000002a00)=""/80, 0x50}, {&(0x7f0000002a80)=""/130, 0x82}], 0x7, &(0x7f0000002bc0)=""/208, 0xd0, 0x5}, 0x2}, {{&(0x7f0000002cc0)=@in, 0x80, &(0x7f0000002e80)=[{&(0x7f0000002d40)=""/212, 0xd4}, {&(0x7f0000002e40)=""/3, 0x3}], 0x2, &(0x7f0000002ec0)=""/4096, 0x1000, 0x3ff}}], 0x4, 0x42, 0x0) accept$packet(0xffffffffffffffff, &(0x7f0000003fc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004000)=0x14) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000300)={{{@in=@multicast1, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in=@dev}}, &(0x7f0000004140)=0xe8) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000004440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000004400)={&(0x7f0000000600)={0x258, r1, 0x0, 0x70bd2a, 0x25dfdbff, {}, [{{0x8, 0x1, r2}, {0x7c, 0x2, [{0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r3}}}]}}, {{0x8, 0x1, r4}, {0xbc, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r5}}, {0x8}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x6}}, {0x8}}}]}}, {{0x8, 0x1, r6}, {0xf4, 0x2, [{0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x5}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r7}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x9}}, {0x8, 0x6, r8}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r9}}}]}}]}, 0x258}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r10 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r10, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r10, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:27 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0x402}) r1 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000000)='/dev/pktcdvd/control\x00', 0x100, 0x0) ioctl$SG_SCSI_RESET(r1, 0x2284, 0x0) 03:36:27 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0", 0x9) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 419.394938] binder: 12497:12503 got transaction to invalid handle [ 419.403278] device lo entered promiscuous mode [ 419.420145] binder: 12497:12503 transaction failed 29201/-22, size 72-40 line 3013 03:36:27 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0", 0x9) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:27 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) socketpair(0x1, 0x0, 0x100000001, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SG_NEXT_CMD_LEN(r1, 0x2283, &(0x7f00000001c0)=0xb5) r3 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) getsockname$packet(0xffffffffffffff9c, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000080)=0x14) ioctl$sock_inet6_SIOCDIFADDR(r3, 0x8936, &(0x7f0000000100)={@loopback, 0x72, r4}) ioctl$sock_inet_SIOCRTMSG(r2, 0x890d, &(0x7f0000000280)={0x8, {0x2, 0x4e23, @loopback}, {0x2, 0x4e22, @broadcast}, {0x2, 0x4e23, @broadcast}, 0x40, 0xffffffff, 0x3, 0x80, 0xfffffffffffffeff, &(0x7f0000000140)='gre0\x00', 0x80, 0x100000001, 0x100000000}) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x29, 0x1, &(0x7f0000000200), 0x4) getsockopt$ARPT_SO_GET_REVISION_TARGET(r0, 0x0, 0x63, &(0x7f0000000300)={'ipvs\x00'}, &(0x7f0000000340)=0x1e) [ 419.427919] device lo left promiscuous mode [ 419.430012] device lo entered promiscuous mode [ 419.436796] binder: 12498:12504 ioctl c0306201 20000440 returned -14 03:36:27 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0", 0x9) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 419.436904] device lo left promiscuous mode [ 419.449590] device lo entered promiscuous mode [ 419.450275] binder: 12497:12508 transaction failed 29189/-22, size 0-0 line 3013 [ 419.452913] device lo left promiscuous mode 03:36:27 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 419.544173] binder: 12517:12518 ioctl c0306201 20000440 returned -14 [ 419.585394] binder: 12524:12525 ioctl c0306201 20000440 returned -14 [ 419.598317] binder: 12497:12503 got transaction to invalid handle [ 419.603371] binder: 12497:12527 transaction failed 29189/-22, size 0-0 line 3013 [ 419.603594] binder: undelivered TRANSACTION_ERROR: 29189 [ 419.619898] device lo entered promiscuous mode [ 419.627092] device lo left promiscuous mode [ 419.629493] binder: 12497:12503 transaction failed 29201/-22, size 72-40 line 3013 [ 419.629546] binder: undelivered TRANSACTION_ERROR: 29189 [ 419.654676] device lo entered promiscuous mode [ 419.661937] binder: 12528:12532 ioctl c0306201 20000440 returned -14 [ 419.671404] device lo entered promiscuous mode [ 419.678643] device lo left promiscuous mode [ 419.684431] device lo left promiscuous mode [ 420.032509] IPVS: Creating netns size=2536 id=99 [ 420.067525] IPVS: Creating netns size=2536 id=100 [ 420.405041] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 420.413795] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 420.430226] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 420.437872] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 420.528973] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 420.536803] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 420.547284] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 420.557144] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 420.641105] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 420.648931] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 420.659797] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 420.668075] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 420.679337] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 420.689875] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 420.696983] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 420.704514] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 420.714865] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 420.722252] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 420.733509] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 420.747854] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 420.754758] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 420.763635] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 421.838569] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 421.859433] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 421.893019] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 421.899197] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 421.907159] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 421.928160] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 421.934480] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 421.941966] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:36:30 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:30 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$EVIOCGBITSW(r0, 0x80404525, &(0x7f0000000000)=""/51) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:30 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:30 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0xffffffffffffffff}) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000000)='/dev/keychord\x00', 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r1, 0x404c534a, &(0x7f0000000040)={0xfff, 0x6, 0x80000001}) 03:36:30 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) listen(0xffffffffffffff9c, 0x1) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) bind$netlink(r1, &(0x7f0000000200)={0x10, 0x0, 0x25dfdbfc, 0x88000}, 0xc) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000180)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="0300000000000026e987f8fec230bb2db558936b940008001b00000e6cf6fbcaac00000000000000000000000000b35ebe940e395a86b52a7ad52d30b6be189a280ed9e2d02e0043c89c16447dc7d99318c149b83978e14b7d79579e93c1581f24a988ffefa95097a83f893c0869681d33f3fcf20f43f17cf9dcb98e4c5d8370641e1acbbe7fe86f990fb4237fc7539f12a252a1058b5b9beeae13662375a9b91c5d947d0b6a1e495fdb1335cbe11e7c54faf1bd0d89e584cc09f6913e4f50009a1ee1cb2d23532f0c2fbbc1b9191a46003088d40a6447427f51b4e3f642553b"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$LOOP_SET_FD(r0, 0x4c00, 0xffffffffffffffff) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:36:30 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f00040000000000000000"], 0x8c) 03:36:30 executing program 4: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) pivot_root(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)='./file0\x00') syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) [ 423.152607] binder: 13294:13297 ioctl 80404525 20000000 returned -22 [ 423.162149] binder_alloc: 13294: binder_alloc_buf failed to map page at 20001000 in userspace [ 423.171506] binder: 13294:13297 transaction failed 29201/-12, size 0-0 line 3136 [ 423.179424] device lo entered promiscuous mode [ 423.180949] device lo entered promiscuous mode 03:36:31 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 423.186451] device lo left promiscuous mode [ 423.201330] binder: 13296:13304 ioctl c0306201 20000440 returned -14 [ 423.213840] binder_alloc: binder_alloc_mmap_handler: 13294 20001000-20004000 already mapped failed -16 [ 423.231759] binder: 13294:13309 ioctl 80404525 20000000 returned -22 [ 423.246800] binder: BINDER_SET_CONTEXT_MGR already set 03:36:31 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x10, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:31 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="00634040000000000000dca5b37500000000000000000000000000100000000000000000a757b8216c43dbff4000d25500000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 423.252348] binder: 13294:13297 ioctl 40046207 0 returned -16 [ 423.258761] binder_alloc: 13294: binder_alloc_buf, no vma [ 423.258781] binder: 13294:13309 transaction failed 29189/-3, size 0-0 line 3136 [ 423.259042] binder: undelivered TRANSACTION_ERROR: 29189 [ 423.259123] binder: undelivered TRANSACTION_ERROR: 29201 [ 423.271701] binder: 13313:13314 ioctl c0306201 20000440 returned -14 03:36:31 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x10, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 423.325859] binder: 13317:13319 transaction failed 29189/-22, size 0-0 line 3013 [ 423.336226] binder: undelivered TRANSACTION_ERROR: 29189 [ 423.347247] binder_alloc: 13321: binder_alloc_buf size -10340440997210136 failed, no address space [ 423.358909] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 423.370907] binder: 13321:13322 transaction failed 29201/-28, size -10340442437036121-1439825984 line 3136 03:36:31 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = gettid() fcntl$setown(r1, 0x8, r2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x802, 0x0) getsockopt$inet6_int(r3, 0x29, 0x48, &(0x7f0000000080), &(0x7f00000000c0)=0x4) [ 423.402951] binder_alloc: 13321: binder_alloc_buf failed to map page at 20001000 in userspace [ 423.412645] binder: 13323:13324 transaction failed 29201/-12, size 0-0 line 3136 [ 423.412773] binder_alloc: binder_alloc_mmap_handler: 13321 20001000-20004000 already mapped failed -16 [ 423.420440] binder: BINDER_SET_CONTEXT_MGR already set [ 423.420448] binder: 13321:13326 ioctl 40046207 0 returned -16 03:36:31 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000003000/0x3000)=nil, 0x3000, 0x1) r2 = creat(&(0x7f0000000140)='./file0\x00', 0x200006) getsockopt$SO_BINDTODEVICE(r2, 0x1, 0x19, &(0x7f00000000c0), 0x10) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340520000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000006dfa1b87227673b1258a35656ee49d5837714f8b5a665fb8bc10d5a967e4c95f84f6bae2c1", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:31 executing program 4: 03:36:31 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) r1 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={0x73, 0x79, 0x7a, 0x3}, &(0x7f00000001c0)="dec80be883989b9481b67879d679a790880079143b4e947ce334ecfaa3fc6af8a1398fcaa3a43d25595dd6750fc4ce43172603f6d0774943c6d94ab30d69aeb30d647b5bddd42edf1b8154c0f0a7bc57c04654b2886d0c220f6acf7a9599d0fc10d6a0d1ff5fb8118e8862a563e8a8cafb2ec25550b921fe3c2e7ed21f7e239599f887402154792eda4b2f551bea119373d991dbbef1886c5b25663675a53390be760a5af2b07568d80296d3f9c9f6a70c30a8b20a6a1a4e8f19317e", 0xbc, 0xfffffffffffffffe) keyctl$revoke(0x3, r1) [ 423.420929] binder: undelivered TRANSACTION_ERROR: 29201 [ 423.447669] binder: 13328:13329 ioctl 40046205 1 returned -22 [ 423.448359] binder_alloc: 13328: binder_alloc_buf failed to map page at 20001000 in userspace [ 423.448446] binder: 13328:13329 transaction failed 29201/-12, size 0-0 line 3136 [ 423.449709] binder_alloc: binder_alloc_mmap_handler: 13328 20001000-20004000 already mapped failed -16 [ 423.449813] binder: 13328:13331 ioctl 40046205 1 returned -22 [ 423.449895] binder: BINDER_SET_CONTEXT_MGR already set [ 423.449903] binder: 13328:13329 ioctl 40046207 0 returned -16 [ 423.450015] binder_alloc: 13328: binder_alloc_buf, no vma [ 423.450032] binder: 13328:13331 transaction failed 29189/-3, size 0-0 line 3136 [ 423.450485] binder: undelivered TRANSACTION_ERROR: 29201 [ 423.450756] binder: undelivered TRANSACTION_ERROR: 29189 [ 423.452795] device lo entered promiscuous mode [ 423.453349] device lo left promiscuous mode [ 423.487075] device lo entered promiscuous mode [ 423.499481] device lo left promiscuous mode [ 423.550477] binder: 13333:13339 unknown command 1379951360 [ 423.550486] binder: 13333:13339 ioctl c0306201 20000440 returned -22 03:36:31 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:31 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:31 executing program 4: 03:36:31 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer\x00', 0x200, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:36:31 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) recvmsg(r0, &(0x7f00000001c0)={&(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, &(0x7f0000000740)=[{&(0x7f0000000240)=""/195, 0xc3}, {&(0x7f0000000340)=""/145, 0x91}, {&(0x7f0000000540)=""/229, 0xe5}, {&(0x7f0000000140)=""/10, 0xa}, {&(0x7f0000000400)=""/127, 0x7f}, {&(0x7f0000000640)=""/202, 0xca}], 0x6, &(0x7f00000007c0)=""/219, 0xdb, 0x7}, 0x40000000) getpeername$packet(0xffffffffffffff9c, &(0x7f0000000b40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000b80)=0x14) ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f0000000bc0)={@dev={0xfe, 0x80, [], 0x1b}, 0x4b, r2}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:31 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'ip6tnl0\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) [ 423.555387] binder_alloc: binder_alloc_mmap_handler: 13333 20001000-20004000 already mapped failed -16 [ 423.559285] binder: BINDER_SET_CONTEXT_MGR already set [ 423.559293] binder: 13333:13341 ioctl 40046207 0 returned -16 [ 423.614772] device lo left promiscuous mode [ 423.617729] device lo entered promiscuous mode [ 423.619965] device lo left promiscuous mode [ 423.677958] binder: undelivered TRANSACTION_ERROR: 29201 [ 423.712646] binder: 13347:13355 got transaction to context manager from process owning it [ 423.717600] device lo entered promiscuous mode [ 423.735686] device lo left promiscuous mode [ 423.749973] binder: 13347:13355 transaction failed 29201/-22, size 0-0 line 3004 [ 423.771763] binder_alloc: binder_alloc_mmap_handler: 13347 20001000-20004000 already mapped failed -16 [ 423.790489] binder: BINDER_SET_CONTEXT_MGR already set [ 423.797243] binder: 13347:13363 ioctl 40046207 0 returned -16 [ 423.803843] binder: undelivered TRANSACTION_ERROR: 29201 03:36:31 executing program 4: 03:36:31 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x10, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:31 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4800) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x61, &(0x7f0000000040)={'filter\x00', 0x4}, 0x68) 03:36:31 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:31 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f000400000000000000000000"], 0x8e) [ 423.907879] device lo entered promiscuous mode [ 423.924435] device lo left promiscuous mode 03:36:31 executing program 4: [ 423.978750] binder_alloc: 13378: binder_alloc_buf failed to map page at 20001000 in userspace [ 423.997740] binder: 13378:13379 transaction failed 29201/-12, size 0-0 line 3136 [ 423.998018] binder_alloc: 13378: binder_alloc_buf failed to map page at 20001000 in userspace 03:36:31 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:31 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0xa8c7, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCSBRK(r4, 0x5427) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="071a000000000000d78fa87bdf7f8330"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r5) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) clock_adjtime(0x3, &(0x7f0000000280)={0x6, 0x80, 0x7, 0x2, 0x8d, 0x7fff, 0xd8, 0x100000000, 0x2ac, 0xffffffffffff8000, 0x3, 0x100000001, 0xf9a, 0x1, 0x6, 0xffffffff, 0x1, 0xffffffff7fffffff, 0x800, 0x9, 0x400, 0x2, 0xbd2, 0xe8c4bae, 0x7fff, 0x1}) 03:36:31 executing program 4: 03:36:31 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000200)={'veth0_to_team\x00', 0x8400}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) getsockopt$IP_VS_SO_GET_SERVICE(r0, 0x0, 0x483, &(0x7f0000000000), &(0x7f0000000080)=0x68) [ 424.015301] binder: 13376:13380 transaction failed 29201/-12, size 0-0 line 3136 [ 424.017264] binder: undelivered TRANSACTION_ERROR: 29201 [ 424.037168] device lo entered promiscuous mode [ 424.039363] device lo left promiscuous mode [ 424.042220] device lo entered promiscuous mode [ 424.044626] device lo left promiscuous mode [ 424.107016] binder_alloc: 13378: binder_alloc_buf failed to map page at 20001000 in userspace [ 424.107588] binder: 13388:13396 transaction failed 29201/-12, size 0-0 line 3136 [ 424.108208] binder: undelivered TRANSACTION_ERROR: 29201 [ 424.172696] binder_alloc: binder_alloc_mmap_handler: 13378 20001000-20004000 already mapped failed -16 [ 424.182421] binder: BINDER_SET_CONTEXT_MGR already set [ 424.188310] binder: 13378:13389 ioctl 40046207 0 returned -16 [ 424.194792] binder: undelivered TRANSACTION_ERROR: 29201 [ 427.288926] IPVS: Creating netns size=2536 id=101 [ 427.460645] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 427.474466] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 427.530331] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 427.543577] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 427.599954] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 427.613307] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 427.627633] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 427.642603] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 428.289553] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 428.323780] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 428.330197] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 428.337192] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:36:37 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:37 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:37 executing program 4: 03:36:37 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) preadv(r0, &(0x7f0000000380)=[{&(0x7f00000001c0)=""/139, 0x8b}, {&(0x7f0000000040)=""/109, 0x6d}, {&(0x7f0000000100)=""/33, 0x21}, {&(0x7f0000000280)=""/127, 0x7f}, {&(0x7f0000000300)=""/76, 0x4c}], 0x5, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x0, 0x0) ioctl$SCSI_IOCTL_START_UNIT(r1, 0x5) ioctl$sock_SIOCBRDELBR(r1, 0x89a1, &(0x7f0000000140)='veth1\x00') 03:36:37 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:37 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000280)='/dev/keychord\x00', 0x4000, 0x0) openat(r3, &(0x7f00000002c0)='./file0\x00', 0x200000, 0x50) r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$TIOCGSID(r4, 0x5429, &(0x7f0000000200)) r5 = getpgid(0xffffffffffffffff) r6 = syz_open_procfs(r5, &(0x7f0000000240)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r6) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:36:37 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x200, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'veth1\x00', 0x0}) sendto$packet(r2, &(0x7f0000000140)="4109af79f46f6ccf156a8c71745bcf84fcf937a85f5b4e89bfe71f51c7de1082a135b48106e4abaded4c28e6f546cddea606f91559724985624b317ca1662e5e3d568afa6adff2", 0x47, 0x4000000, &(0x7f00000001c0)={0x11, 0x0, r3, 0x1, 0x100000001, 0x6, @dev={[], 0x19}}, 0x14) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:37 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f000400000000000000000000"], 0x8e) 03:36:37 executing program 4: 03:36:37 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:37 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x40000, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 429.394902] device lo entered promiscuous mode [ 429.401239] binder: 13791:13799 ioctl 8933 200000c0 returned -22 [ 429.401533] binder: 13791:13799 transaction failed 29189/-22, size 0-0 line 3013 [ 429.418468] binder_alloc: 13791: binder_alloc_buf failed to map page at 20001000 in userspace 03:36:37 executing program 4: 03:36:37 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063c0400000f800000000000000000000000000000000000000000000000000800000000000000000000000000000000000d55b", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x300, 0x2) [ 429.424448] binder: 13788:13796 transaction failed 29201/-12, size 0-0 line 3136 [ 429.426293] binder: undelivered TRANSACTION_ERROR: 29201 03:36:37 executing program 4: 03:36:37 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(0xffffffffffffffff, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:37 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) mmap(&(0x7f0000004000/0x1000)=nil, 0x1000, 0xa, 0x20010, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) fcntl$dupfd(r0, 0x406, r1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 429.426767] binder_alloc: binder_alloc_mmap_handler: 13791 20001000-20004000 already mapped failed -16 [ 429.432967] binder: 13791:13801 ioctl 8933 200000c0 returned -22 [ 429.433040] binder: BINDER_SET_CONTEXT_MGR already set [ 429.433048] binder: 13791:13799 ioctl 40046207 0 returned -16 [ 429.433830] binder: undelivered TRANSACTION_ERROR: 29189 [ 429.474323] binder_alloc: 13810: binder_alloc_buf failed to map page at 20001000 in userspace [ 429.474363] binder: 13810:13815 transaction failed 29201/-12, size 0-0 line 3136 [ 429.475342] binder_alloc: binder_alloc_mmap_handler: 13810 20001000-20004000 already mapped failed -16 [ 429.475731] binder: BINDER_SET_CONTEXT_MGR already set [ 429.475739] binder: 13810:13817 ioctl 40046207 0 returned -16 [ 429.475928] binder_alloc: 13810: binder_alloc_buf, no vma [ 429.475946] binder: 13810:13817 transaction failed 29189/-3, size 0-0 line 3136 [ 429.476123] binder: undelivered TRANSACTION_ERROR: 29201 [ 429.476404] binder: undelivered TRANSACTION_ERROR: 29189 [ 429.513265] binder: 13812:13816 transaction failed 29189/-22, size 0-0 line 3013 [ 429.513594] binder: undelivered TRANSACTION_ERROR: 29189 [ 429.531732] binder: BINDER_SET_CONTEXT_MGR already set [ 429.531740] binder: 13823:13824 ioctl 40046207 0 returned -16 [ 429.563073] binder: 13829:13830 ioctl c0306201 20000440 returned -14 [ 429.570927] binder_alloc: 13832: binder_alloc_buf failed to map page at 20001000 in userspace [ 429.570959] binder: 13832:13834 transaction failed 29201/-12, size 0-0 line 3136 [ 429.574724] binder_alloc: binder_alloc_mmap_handler: 13832 20001000-20004000 already mapped failed -16 [ 429.574880] binder: BINDER_SET_CONTEXT_MGR already set [ 429.574887] binder: 13832:13834 ioctl 40046207 0 returned -16 [ 429.575394] binder: undelivered TRANSACTION_ERROR: 29201 [ 429.728974] device lo entered promiscuous mode [ 429.738020] device lo left promiscuous mode [ 429.743776] device lo left promiscuous mode [ 429.798992] device lo entered promiscuous mode [ 429.804817] device lo entered promiscuous mode [ 429.812964] device lo left promiscuous mode 03:36:37 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(0xffffffffffffffff, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:37 executing program 4: 03:36:37 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)={'syz0', "b973b0a64a08ed6f3bbd78b0ce76dc5051c465866b9986d4ef79f4f3e4ffb5f7b4a5220a9ee2641f0d0d624dba6964510cf44c10f0bf8a51c09fc8b79ce06b5dc6459f14708afedcf00e9496fb3d3de9c1b3ef86ecec645dce0865c72aae60384f868e8d0186f4a9bdd4cb0daa88658aaacf4b718cc132b52b93d77f1025f379e12c8cb5476cca8de92197cdaeb9c44cb3d91f806917b371307f0eb9f3b9e7359035a7bd5b495a4053dc2a0627470eda508816d19382681f487e108bf60b1673499afc7ea8fab171ae2afa99c0df352d582b956436dd"}, 0xda) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:37 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140), 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:37 executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:37 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000200)='/dev/sequencer\x00', 0x40, 0x0) ioctl$TIOCLINUX6(r2, 0x541c, &(0x7f0000000280)={0x6, 0x4}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r4 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008f2650000020000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r5) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:36:37 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) fsync(r0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) [ 429.923684] device lo left promiscuous mode [ 429.930230] binder_alloc: 13844: binder_alloc_buf failed to map page at 20001000 in userspace [ 429.930262] binder: 13844:13849 transaction failed 29201/-12, size 0-0 line 3136 [ 429.931359] binder: BINDER_SET_CONTEXT_MGR already set [ 429.931368] binder: 13844:13849 ioctl 40046207 0 returned -16 [ 429.932195] binder_alloc: 13844: binder_alloc_buf, no vma [ 429.932213] binder: 13844:13855 transaction failed 29189/-3, size 0-0 line 3136 [ 429.932540] binder: undelivered TRANSACTION_ERROR: 29189 [ 429.932607] binder: undelivered TRANSACTION_ERROR: 29201 [ 429.940806] binder: 13842:13852 ioctl c0306201 20000440 returned -14 [ 430.028186] device lo entered promiscuous mode [ 430.039078] device lo left promiscuous mode [ 430.098056] device lo entered promiscuous mode [ 430.103812] device lo left promiscuous mode [ 430.111942] device lo entered promiscuous mode [ 430.120536] device lo left promiscuous mode 03:36:38 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f000400000000000000000000"], 0x8e) 03:36:38 executing program 4: 03:36:38 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x4, 0x20011, r0, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000011242c29d2bca476460000000000000000000000000000000000000000a17f5c6fa50ed1864ea8e5c41a3c1f3e6fa5c0ec283c1ff9665dc6c9c6ee37f4560c1c765e491ff3456f64443df3cdb5a0329df315323fef1f841508f11d87de7b496e0087b1e995fcbd3ce589cd3cfc572d503c6fbbfdbbfc0e166037f90000000000006e8634665b5dcd5976ee0b24c83ec8b0bdb055c8d28eec583a", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:38 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(0xffffffffffffffff, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:38 executing program 1: 03:36:38 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000300)={0x7, 0x3, 0x7, 0xfc8, 0x7}, 0x14) ioctl$TIOCSCTTY(r1, 0x540e, 0xfff) socketpair(0xa, 0x80807, 0x9, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCGPROP(r2, 0x80404509, &(0x7f0000000240)=""/137) r3 = fcntl$getown(r0, 0x9) ptrace$setsig(0x4203, r3, 0x1, &(0x7f0000000080)={0x3f, 0xff, 0x4, 0x4}) r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x16000, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000340)={"6c6f00000000000000000000000200"}) ioctl$KDGKBMETA(r4, 0x4b62, &(0x7f0000000040)) write$FUSE_LSEEK(r4, &(0x7f0000000140)={0x18, 0xffffffffffffffff, 0x5, {0x400000000000}}, 0x18) 03:36:38 executing program 1: 03:36:38 executing program 4: 03:36:38 executing program 1: r0 = add_key$keyring(&(0x7f0000000080)='keyring\x00', &(0x7f00000000c0), 0x0, 0x0, 0xfffffffffffffffd) keyctl$get_security(0x11, r0, &(0x7f0000000140)=""/166, 0xa6) 03:36:38 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)={0x0, {{0xa, 0x0, 0x0, @mcast1}}, {{0xa, 0x0, 0x0, @local}}}, 0x165) getsockopt$inet6_buf(r0, 0x29, 0x30, &(0x7f0000000000)=""/40, &(0x7f00000001c0)=0x114) [ 430.229007] binder: 13872:13878 ioctl c0306201 20000440 returned -14 [ 430.239708] binder_alloc: 13871: binder_alloc_buf, no vma [ 430.239728] binder: 13871:13877 transaction failed 29189/-3, size 302638218450-0 line 3136 [ 430.254532] binder: BINDER_SET_CONTEXT_MGR already set [ 430.254540] binder: 13871:13882 ioctl 40046207 0 returned -16 [ 430.254935] binder: undelivered TRANSACTION_ERROR: 29189 [ 430.256417] device lo entered promiscuous mode [ 430.262885] device lo left promiscuous mode [ 430.424625] device lo entered promiscuous mode [ 430.430949] device lo left promiscuous mode [ 432.878782] IPVS: Creating netns size=2536 id=102 [ 433.048313] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 433.061971] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 433.120173] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 433.133860] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 433.190404] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 433.204244] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 433.218918] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 433.233139] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 433.882985] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 433.917436] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 433.923537] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 433.930959] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:36:42 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140), 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:42 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040e30000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080)='/dev/sequencer2\x00', 0x200, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'veth1\x00', 0x0}) sendto$packet(r2, &(0x7f0000000140)="4109af79f46f6ccf156a8c71745bcf84fcf937a85f5b4e89bfe71f51c7de1082a135b48106e4abaded4c28e6f546cddea606f91559724985624b317ca1662e5e3d568afa6adff2", 0x47, 0x4000000, &(0x7f00000001c0)={0x11, 0x0, r3, 0x1, 0x100000001, 0x6, @dev={[], 0x19}}, 0x14) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:42 executing program 4: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0xa8c7, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$TIOCSBRK(r4, 0x5427) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="071a000000000000d78fa87bdf7f8330"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r5) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) clock_adjtime(0x3, &(0x7f0000000280)={0x6, 0x80, 0x7, 0x2, 0x8d, 0x7fff, 0xd8, 0x100000000, 0x2ac, 0xffffffffffff8000, 0x3, 0x100000001, 0xf9a, 0x1, 0x6, 0xffffffff, 0x1, 0xffffffff7fffffff, 0x800, 0x9, 0x400, 0x2, 0xbd2, 0xe8c4bae, 0x7fff, 0x1}) 03:36:42 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="03000004003586c80200d829000873"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x4, 0x121200) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:36:42 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:42 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) bind(r0, &(0x7f0000000240)=@rc={0x1f, {0x7, 0x5, 0x9, 0x4, 0xe11, 0x1}, 0x4}, 0x80) clock_gettime(0x0, &(0x7f0000000000)={0x0, 0x0}) setitimer(0x1, &(0x7f0000000040)={{r1, r2/1000+10000}, {0x77359400}}, 0x0) 03:36:42 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f00040000000000000000000000"], 0x8f) 03:36:42 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000003000/0x1000)=nil, 0x1000, 0x44) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 434.981114] binder: 14280:14285 ioctl c0306201 20000440 returned -14 03:36:42 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140), 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) [ 434.983195] binder: 14279:14286 got transaction to invalid handle [ 434.983203] binder: 14279:14286 transaction failed 29201/-22, size 0-0 line 3013 03:36:42 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x12) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) creat(&(0x7f0000000080)='./file0\x00', 0x88) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x20000, 0x0) ioctl$LOOP_SET_CAPACITY(r2, 0x4c07) setsockopt$inet6_tcp_TLS_RX(r2, 0x6, 0x2, &(0x7f0000000040), 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 434.990588] binder: 14281:14287 ioctl 8933 200000c0 returned -22 [ 434.990798] binder: BINDER_SET_CONTEXT_MGR already set [ 434.990807] binder: 14281:14287 ioctl 40046207 0 returned -16 03:36:42 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x2) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) keyctl$session_to_parent(0x12) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 434.991323] binder: 14281:14287 transaction failed 29189/-22, size 0-0 line 3013 [ 434.991559] binder: undelivered TRANSACTION_ERROR: 29189 [ 434.994672] binder: BINDER_SET_CONTEXT_MGR already set [ 434.994680] binder: 14279:14286 ioctl 40046207 0 returned -16 [ 434.994758] binder: 14279:14291 got transaction to invalid handle 03:36:43 executing program 7: sigaltstack(&(0x7f0000003000/0x1000)=nil, &(0x7f0000000240)) r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/autofs\x00', 0x80000, 0x0) ioctl$GIO_SCRNMAP(r2, 0x4b40, &(0x7f0000000140)=""/203) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x10, 0x0, &(0x7f0000000300)=ANY=[@ANYRES32=r1, @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYRES32=r0], 0x0, 0x0, &(0x7f00000003c0)}) syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0x0, 0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x0, 0x0) ioctl$RTC_ALM_SET(r3, 0x40247007, &(0x7f0000000080)={0x23, 0x29, 0xa, 0x18, 0x5, 0x80000000, 0x4, 0xd8}) write$selinux_access(r3, &(0x7f0000000280)={'system_u:object_r:policy_src_t:s0', 0x20, '/usr/sbin/cups-browsed', 0x20, 0xffffffffffffffa6}, 0x4e) [ 434.994767] binder: 14279:14291 transaction failed 29201/-22, size 0-0 line 3013 [ 434.994915] binder: undelivered TRANSACTION_ERROR: 29201 [ 434.995429] binder: undelivered TRANSACTION_ERROR: 29201 [ 435.003521] device lo entered promiscuous mode [ 435.011879] device lo left promiscuous mode [ 435.055398] binder_alloc: binder_alloc_mmap_handler: 14296 20001000-20004000 already mapped failed -16 [ 435.055500] binder: BINDER_SET_CONTEXT_MGR already set [ 435.055508] binder: 14296:14301 ioctl 40046207 0 returned -16 [ 435.055814] binder: send failed reply for transaction 244 to 14296:14299 [ 435.055886] binder: undelivered TRANSACTION_COMPLETE [ 435.055892] binder: undelivered TRANSACTION_ERROR: 29189 [ 435.102981] binder_alloc: binder_alloc_mmap_handler: 14307 20001000-20004000 already mapped failed -16 [ 435.108972] binder: BINDER_SET_CONTEXT_MGR already set [ 435.108980] binder: 14307:14309 ioctl 40046207 0 returned -16 03:36:43 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) r2 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/enforce\x00', 0x400, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r2, 0x10e, 0x3, &(0x7f0000000040)=0x48, 0x4) [ 435.114462] binder: send failed reply for transaction 246 to 14307:14308 [ 435.114521] binder: undelivered TRANSACTION_COMPLETE [ 435.114528] binder: undelivered TRANSACTION_ERROR: 29189 [ 435.184030] binder: 14313:14314 transaction failed 29189/-22, size 0-0 line 3013 [ 435.189729] binder_alloc: binder_alloc_mmap_handler: 14313 20001000-20004000 already mapped failed -16 [ 435.190121] binder: BINDER_SET_CONTEXT_MGR already set 03:36:43 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) r2 = memfd_create(&(0x7f0000000000)='/dev/binder#\x00', 0x2) ioctl$LOOP_SET_FD(r2, 0x4c00, r1) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x2) openat$cgroup_type(r2, &(0x7f0000000080)='cgroup.type\x00', 0x2, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:43 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 435.190128] binder: 14313:14315 ioctl 40046207 0 returned -16 [ 435.194342] binder: undelivered TRANSACTION_ERROR: 29189 [ 435.235592] binder: 14319:14320 unknown command 4 [ 435.235601] binder: 14319:14320 ioctl c0306201 20000440 returned -22 [ 435.256948] binder: BINDER_SET_CONTEXT_MGR already set [ 435.256957] binder: 14319:14320 ioctl 40046207 0 returned -16 [ 435.262413] binder: 14319:14321 unknown command 9 [ 435.262421] binder: 14319:14321 ioctl c0306201 20000440 returned -22 [ 435.301585] binder_alloc: 14323: binder_alloc_buf failed to map page at 20001000 in userspace [ 435.315572] binder: 14323:14325 transaction failed 29201/-12, size 0-0 line 3136 [ 435.317480] device lo entered promiscuous mode [ 435.319885] binder_alloc: binder_alloc_mmap_handler: 14323 20001000-20004000 already mapped failed -16 [ 435.319983] binder: BINDER_SET_CONTEXT_MGR already set [ 435.319990] binder: 14323:14326 ioctl 40046207 0 returned -16 03:36:43 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) write$P9_RLINK(r1, &(0x7f0000000040)={0x7, 0x47, 0x1}, 0x7) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) ioctl$BLKGETSIZE64(r0, 0x80081272, &(0x7f0000000000)) 03:36:43 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063404000000000de2d2e7ef0f3777f00000000000000000000000000000075c2b12da6da35cb43a7a3315dfbe6b70000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) r2 = dup(r1) ioctl$BLKSECTGET(r2, 0x1267, &(0x7f0000000000)) 03:36:43 executing program 4: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCOUTQ(r0, 0x5411, &(0x7f0000000000)) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) recvmsg(r0, &(0x7f00000001c0)={&(0x7f0000000040)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev}}}, 0x80, &(0x7f0000000740)=[{&(0x7f0000000240)=""/195, 0xc3}, {&(0x7f0000000340)=""/145, 0x91}, {&(0x7f0000000540)=""/229, 0xe5}, {&(0x7f0000000140)=""/10, 0xa}, {&(0x7f0000000400)=""/127, 0x7f}, {&(0x7f0000000640)=""/202, 0xca}], 0x6, &(0x7f00000007c0)=""/219, 0xdb, 0x7}, 0x40000000) getpeername$packet(0xffffffffffffff9c, &(0x7f0000000b40)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000b80)=0x14) ioctl$sock_inet6_SIOCDIFADDR(r1, 0x8936, &(0x7f0000000bc0)={@dev={0xfe, 0x80, [], 0x1b}, 0x4b, r2}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:43 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140), 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:43 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000800000008001b001b000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000200)=[{0x2, 0x5}, {0x3, 0x1}, {0x4, 0x400}, {0xc, 0x6}], 0x4) ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) [ 435.320090] binder_alloc: 14323: binder_alloc_buf, no vma [ 435.320107] binder: 14323:14325 transaction failed 29189/-3, size 0-0 line 3136 [ 435.320543] binder: undelivered TRANSACTION_ERROR: 29189 [ 435.320604] binder: undelivered TRANSACTION_ERROR: 29201 [ 435.321558] device lo left promiscuous mode [ 435.351399] binder_alloc: 14328: binder_alloc_buf failed to map page at 20001000 in userspace [ 435.351428] binder: 14328:14329 transaction failed 29201/-12, size 0-0 line 3136 [ 435.352693] binder: BINDER_SET_CONTEXT_MGR already set [ 435.352701] binder: 14328:14329 ioctl 40046207 0 returned -16 [ 435.352741] binder_alloc: 14328: binder_alloc_buf, no vma [ 435.352757] binder: 14328:14330 transaction failed 29189/-3, size 0-0 line 3136 [ 435.353171] binder: undelivered TRANSACTION_ERROR: 29189 [ 435.353232] binder: undelivered TRANSACTION_ERROR: 29201 [ 435.404981] binder: 14332:14333 got transaction to invalid handle [ 435.404990] binder: 14332:14333 transaction failed 29201/-22, size 0-0 line 3013 [ 435.414292] binder_alloc: binder_alloc_mmap_handler: 14332 20001000-20004000 already mapped failed -16 [ 435.418843] binder: BINDER_SET_CONTEXT_MGR already set [ 435.418850] binder: 14332:14334 ioctl 40046207 0 returned -16 [ 435.419245] binder: undelivered TRANSACTION_ERROR: 29201 [ 435.512475] device lo entered promiscuous mode [ 435.523787] binder_alloc: 14340: binder_alloc_buf size 6715328458190429408 failed, no address space [ 435.523794] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 435.523813] binder: 14340:14344 transaction failed 29201/-28, size 6715328458178377178-12052219 line 3136 [ 435.524591] binder: 14340:14344 ioctl 1267 20000000 returned -22 [ 435.534015] device lo left promiscuous mode 03:36:43 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:43 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000040)={'veth0_to_bond\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={'lo\x00'}) 03:36:43 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x3) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x20011, r0, 0xfffffffffffffffd) r2 = mmap$binder(&(0x7f0000004000/0x3000)=nil, 0x3000, 0x7, 0x10010, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000240)={0xd4, 0x0, &(0x7f0000000140)=[@clear_death={0x400c630f, 0x2, 0x1}, @decrefs, @acquire_done={0x40106309, r2, 0x2}, @register_looper, @transaction={0x40406300, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x38, 0x10, &(0x7f0000000000)=[@fda={0x66646185, 0x6, 0x2, 0x2e}, @fd={0x66642a85, 0x0, r1, 0x0, 0x3}], &(0x7f0000000040)=[0x18, 0x78]}}, @decrefs={0x40046307, 0x1}, @dead_binder_done={0x40086310, 0x4}, @transaction_sg={0x40486311, {{0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30, &(0x7f0000000080), &(0x7f00000000c0)=[0x78, 0x0, 0x78, 0x40, 0x20, 0x40]}, 0xd2}}], 0xe8, 0x0, &(0x7f0000000480)="e0357bee3508536b1ac00ecad58e885b99e98d243891d4b5c44e4242b1bf45177a8d12e95a01bea80bc18d0137c51396c5ad3bf351f288d8f45f50aab876f9cdc639cd5d2f90e4565a00ba7f6977a02e8714cd1a97d525de7dfbf758711856176a36d262ed3dcbba3ded4f9bf41b2daca74ed16db3178f79d5016380e21cc8f8d1272b39b1c7ff79318f450a9b53d2587e8a8afb629ccf687e121512eb4497d550378ae36cc16b0bca53470a100cdd3e41576eb97ee46f021806b197f903424de1117beebada6b0d75098663e2c5f63da7cfc5ba19a9511a2429427a8f12ea211b56fde764c43cf9"}) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$TIOCGPGRP(0xffffffffffffffff, 0x540f, &(0x7f0000000280)=0x0) get_robust_list(r3, &(0x7f00000005c0)=&(0x7f0000000580)={&(0x7f0000000380)={&(0x7f00000002c0)}, 0x0, &(0x7f0000000400)={&(0x7f00000003c0)}}, &(0x7f0000000600)=0x18) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:43 executing program 4: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x10000000003, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = userfaultfd(0x80000) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000fff000/0x1000)=nil, 0x1000}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) [ 435.537082] binder_alloc: binder_alloc_mmap_handler: 14340 20001000-20004000 already mapped failed -16 [ 435.537920] binder: BINDER_SET_CONTEXT_MGR already set [ 435.537930] binder: 14340:14348 ioctl 40046207 0 returned -16 [ 435.538102] binder_alloc: 14340: binder_alloc_buf, no vma [ 435.538135] binder: 14340:14344 transaction failed 29189/-3, size 6715328458178377178-12052219 line 3136 [ 435.538539] binder: undelivered TRANSACTION_ERROR: 29201 [ 435.538876] binder: undelivered TRANSACTION_ERROR: 29189 [ 435.791931] binder: 14358:14359 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 435.800612] binder: 14358:14359 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 435.811481] device veth0_to_bond entered promiscuous mode [ 435.812657] device lo entered promiscuous mode 03:36:43 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x10000000003, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = userfaultfd(0x80000) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000fff000/0x1000)=nil, 0x1000}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:43 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f00040000000000000000000000"], 0x8f) 03:36:43 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) r2 = accept4(r1, &(0x7f0000000000)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x80, 0x80800) r3 = syz_genetlink_get_family_id$team(&(0x7f00000001c0)='team\x00') getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000240)={{{@in=@multicast1, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in6=@ipv4={[], [], @local}}}, &(0x7f0000000340)=0xe8) accept$packet(0xffffffffffffff9c, &(0x7f0000001940)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000001980)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f00000019c0)={'team0\x00', 0x0}) creat(&(0x7f00000003c0)='./file0\x00', 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000001a00)={0x11, 0x0, 0x0}, &(0x7f0000001a40)=0x14) clock_gettime(0x0, &(0x7f000000a040)={0x0, 0x0}) recvmmsg(r1, &(0x7f0000009ec0)=[{{&(0x7f0000001a80)=@llc, 0x80, &(0x7f0000004f80)=[{&(0x7f0000001b00)=""/4096, 0x1000}, {&(0x7f0000002b00)=""/196, 0xc4}, {&(0x7f0000002c00)=""/200, 0xc8}, {&(0x7f0000002d00)=""/226, 0xe2}, {&(0x7f0000002e00)=""/117, 0x75}, {&(0x7f0000002e80)=""/4096, 0x1000}, {&(0x7f0000003e80)=""/4096, 0x1000}, {&(0x7f0000004e80)=""/211, 0xd3}], 0x8, 0x0, 0x0, 0xa07b}, 0x20}, {{&(0x7f0000005000)=@hci={0x1f, 0x0}, 0x80, &(0x7f0000005080), 0x0, &(0x7f00000050c0)=""/25, 0x19}, 0x9}, {{&(0x7f0000005100)=@pppoe={0x18, 0x0, {0x0, @random}}, 0x80, &(0x7f0000005180), 0x0, &(0x7f00000051c0)=""/4096, 0x1000}, 0x9}, {{&(0x7f00000061c0)=@nfc_llcp, 0x80, &(0x7f0000007240)=[{&(0x7f0000006240)=""/4096, 0x1000}], 0x1, &(0x7f0000007280)=""/231, 0xe7, 0x8}, 0x1ff}, {{&(0x7f0000007380)=@in={0x2, 0x0, @remote}, 0x80, &(0x7f0000008680)=[{&(0x7f0000007400)=""/25, 0x19}, {&(0x7f0000007440)=""/150, 0x96}, {&(0x7f0000007500)=""/122, 0x7a}, {&(0x7f0000007580)=""/233, 0xe9}, {&(0x7f0000007680)=""/4096, 0x1000}], 0x5, &(0x7f0000008700)=""/41, 0x29}, 0x401}, {{&(0x7f0000008740)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @local}}}, 0x80, &(0x7f0000009d80)=[{&(0x7f00000087c0)=""/107, 0x6b}, {&(0x7f0000008840)=""/118, 0x76}, {&(0x7f00000088c0)=""/4096, 0x1000}, {&(0x7f00000098c0)=""/112, 0x70}, {&(0x7f0000009940)=""/180, 0xb4}, {&(0x7f0000009a00)=""/136, 0x88}, {&(0x7f0000009ac0)=""/133, 0x85}, {&(0x7f0000009b80)=""/52, 0x34}, {&(0x7f0000009bc0)=""/198, 0xc6}, {&(0x7f0000009cc0)=""/153, 0x99}], 0xa, &(0x7f0000009e40)=""/70, 0x46, 0x6}, 0x5}], 0x6, 0x1, &(0x7f000000a080)={r8, r9+10000000}) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f000000a0c0)={{{@in6=@remote, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@local}}, &(0x7f000000a1c0)=0xe8) getsockopt$inet_pktinfo(r1, 0x0, 0x8, &(0x7f000000a200)={0x0, @empty, @multicast1}, &(0x7f000000a240)=0xc) getsockname$packet(0xffffffffffffffff, &(0x7f000000a380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f000000a3c0)=0x14) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f000000a400)={{{@in=@loopback, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}}}, &(0x7f000000a500)=0xe8) ioctl$IOC_PR_PREEMPT_ABORT(r0, 0x401870cc, &(0x7f0000000380)={0x7, 0x8, 0x0, 0x2}) sendmsg$TEAM_CMD_PORT_LIST_GET(r2, &(0x7f000000a900)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0xa0}, 0xc, &(0x7f000000a8c0)={&(0x7f000000a540)=ANY=[@ANYBLOB="50030000", @ANYRES16=r3, @ANYBLOB="000827bd7000fddbdf250300000008000100", @ANYRES32=r4, @ANYBLOB="800002003c000100240001006c625f74785f6d6574686f64000000000000000100000000000000000000000008000300050000000c000400686173680000000040000100240001006c625f686173685f737461747300000000000000000000000000000000000000080003000b0000000800040000000000080007000000000008000100", @ANYRES32=r5, @ANYBLOB="b80002003800010024000100616374697665706f727400000000000000000000000000000000000000000000080003000300000008000400", @ANYRES32=r6, @ANYBLOB="7c000100240001006270665f686173685f66756e6300000000000000000000000000000000000000080003000b0000004c00040003000800a20700000800740807000000001001079e0300000000d4070300000001000300ffffff7f0700040403000000000008b6b30800000000090908000000ffff01f55500000008000100", @ANYRES32=r7, @ANYBLOB="6801020038000100240001006d636173745f72656a6f696e5f696e74657276616c0000000000000000000000080003000300000008000400ffff000040000100240001006c625f706f72745f737461747300000000000000000000000000000000000000080003000b000000080004000100000008000600", @ANYRES32=r10, @ANYBLOB="400001002400010071756575655f69640000000000000000000000000000000000000000000000000800030003000000080004009c11000008000600", @ANYRES32=r11, @ANYBLOB="3c000100240001006d6f64650000000000000000000000000000000000000000000000000000000008000300050000000c00040072616e646f6d000038000100240001006d636173745f72656a6f696e5f696e74657276616c00000000000000000000000800030003000000080004000100008038000100240001006d636173745f72656a6f696e5f636f756e7400000000000000000000000000000800030003000000080004000800000008000100", @ANYRES32=r12, @ANYBLOB="7c0002003c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r13, @ANYBLOB="3c00010024000100757365725f6c696e6b757000000000000000000000000000000000000000000008000300060000000400040008000600", @ANYRES32=r14], 0x350}, 0x1, 0x0, 0x0, 0x4000005}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:43 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, 0xffffffffffffffff, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 435.842544] binder: 14358:14359 BC_ACQUIRE_DONE u0000000000000000 no match [ 435.852084] binder: 14358:14369 transaction failed 29189/-22, size 0-0 line 3013 03:36:43 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[@ANYBLOB="037975ffff08001b00000000003b5bb2caa46fd0a4ee7ddfa7a498464db4d97b70919d126dc26bc72053c95b6ec2b1d04824ea26b39e6bba60f569c1524bb83316355c5d722ce0dc214c8c178b686a90ec853e35dc76f00be3f4b3881bd72a71c383cef42ade58cf0da84d598045c361b2bb2d2fe8ea40dc8b6cbd1c6dc4c737237c179a5040bd96aec2575b1caaf3c18f12ae922d0c6d000f74057ac25a7787e820a005064527d01d078e658beebbaa92dbeba87e16b3f49fdad38ea243bd71c5c0156744bda5fc09759cea51d146727a8b5e48d250c8c64914ef10ad92e4d82823aad5dee2c2fd6c7a867c9941e9f0f63afa5db76050d8e7297c1d59c2d5f5534ce21301508389f4676eb0635e9a091b499f16869093adfbf97f5305db8c81b0b1f021957c32b5c4236581a22ac69d800d7535c15f624ad2662155c43026e2f359c6fe186628833ed426204a8797a509731bfdc6a77933c89bddb8e6ab028b136fefc70dabefbd628763aff60bddbc00f1ac0cada1ea1cbfa09f46181a0b485c006f087700f869cd4d2f040cb86813003864"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$BLKPG(r1, 0x1269, &(0x7f0000000200)={0x8, 0x3, 0x96, &(0x7f0000000280)="351fbb43fc93691c88aada3e31221de8176656d0c8d1c46eb27caecb68d9df5579625d668d6353a83f9801add4efbdb08d5e3dec9146f74d2e5912f00f7f8d6256bacf18b116a2ef4b7ed07dccd4d4fb9a9b836ec09357f16fa6bea86437abd9418b0e9d681223d59680341e8e340a0cd19ba8c639fb7c0c243b96754c6cbb1626b719defc674f0049f2171da9f624c8464c9664d1fb"}) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:36:43 executing program 4: r0 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) getsockopt$inet6_tcp_int(r0, 0x6, 0x18, &(0x7f0000000280), &(0x7f00000002c0)=0x4) r1 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r2 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) socketpair(0x1f, 0x80a, 0x81, &(0x7f0000000300)) sendmsg$nl_route(r6, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYRESDEC=r5], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r7 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r1, 0x4c00, r7) ioctl$LOOP_CHANGE_FD(r1, 0x4c06, r2) ioctl$sock_proto_private(r4, 0x89ea, &(0x7f0000000180)="de70fdfc85d0ab") 03:36:43 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 435.852586] binder: 14364:14366 ioctl c0306201 20000440 returned -14 [ 435.854241] device lo left promiscuous mode [ 435.898715] binder: 14358:14359 ERROR: BC_REGISTER_LOOPER called without request [ 435.917496] device lo entered promiscuous mode [ 435.926926] binder: 14358:14359 got transaction to invalid handle [ 435.930145] binder: 14376:14377 ioctl c0306201 20000440 returned -14 03:36:43 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) r2 = dup2(r0, r1) ioctl$PIO_UNIMAPCLR(r2, 0x4b68, &(0x7f0000000000)={0x3, 0x8, 0x6}) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 435.974550] binder: 14385:14388 ioctl c0306201 20000440 returned -14 [ 435.978977] binder: 14358:14359 transaction failed 29201/-22, size 56-16 line 3013 [ 435.996100] binder: 14358:14393 BC_CLEAR_DEATH_NOTIFICATION invalid ref 2 [ 435.996113] binder: 14358:14393 DecRefs 0 refcount change on invalid ref 0 ret -22 [ 435.996129] binder: 14358:14393 BC_ACQUIRE_DONE u0000000000000000 node 261 cookie mismatch 0000000000000002 != 0000000000000000 [ 435.996139] binder: 14358:14393 ERROR: BC_REGISTER_LOOPER called without request [ 435.996147] binder: 14358:14393 got transaction to invalid handle [ 435.996155] binder: 14358:14393 transaction failed 29201/-22, size 56-16 line 3013 [ 435.996354] binder: BINDER_SET_CONTEXT_MGR already set [ 435.996361] binder: 14358:14369 ioctl 40046207 0 returned -16 [ 435.996717] binder: undelivered TRANSACTION_ERROR: 29189 [ 436.000166] device lo left promiscuous mode [ 436.038688] binder: 14399:14400 ioctl 4b68 20000000 returned -22 [ 436.038853] binder: 14399:14400 got transaction to context manager from process owning it [ 436.038865] binder: 14399:14400 transaction failed 29201/-22, size 0-0 line 3004 [ 436.043306] binder: 14399:14400 ioctl 4b68 20000000 returned -22 [ 436.043334] binder: BINDER_SET_CONTEXT_MGR already set [ 436.043342] binder: 14399:14401 ioctl 40046207 0 returned -16 [ 436.053744] binder: undelivered TRANSACTION_ERROR: 29201 [ 436.183522] device lo entered promiscuous mode [ 436.207121] device lo left promiscuous mode [ 436.501924] IPVS: Creating netns size=2536 id=103 [ 436.691054] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 436.708135] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 436.785943] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 436.800940] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 436.878288] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 436.892168] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 436.906888] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 436.921846] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 437.571657] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 437.605679] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 437.611808] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 437.619638] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:36:46 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db10", 0x2) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:46 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) mmap$binder(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x0, 0x810, r0, 0x0) 03:36:46 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x10000000003, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = userfaultfd(0x80000) ioctl$UFFDIO_WAKE(r2, 0x8010aa02, &(0x7f0000000040)={&(0x7f0000fff000/0x1000)=nil, 0x1000}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:46 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:46 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:46 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = getpgid(0xffffffffffffffff) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r1, 0x10, &(0x7f0000000000)) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:46 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f00000002c0)="754d6faf2d0c9672d95fb4f80c704bf682c443c8bab75ac25f4753ab6ba9e0c643fa769d7075a9a5ef7ea9d97d5e81db3a19d48ab08faf9e9f310990a2dbe685928e412e58552a71db171e0e211f31baa0692c7082d59f91960bd19db74ac7d9f5e7a206247f98ce5be7455dc37e4b29f46072557c983f73ab1986ea689da58431c5c594d5145fd3016a965fb4dc5cb944b8bd5df45a11d0936fc621163ce599e302a30c5ea1f6cecfe531cefe3b75969d990c537e0a9ddd12f899c52c5286508d25854ef7823867e463bb001bd0933f10b2d200e3476bd0450dff4edde77a811e31d9e518e5b9d5e955a7a1decc7595a9361cca2ddeceb6aa9976827a5e4469") r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f0000000440), 0xc, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[]}}, 0x2) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) syz_open_dev$usbmon(&(0x7f0000000200)='/dev/usbmon#\x00', 0x6, 0x2000) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:36:46 executing program 2: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f00040000000000000000000000"], 0x8f) 03:36:46 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ppp\x00', 0x10000, 0x0) ioctl$GIO_FONT(r2, 0x4b60, &(0x7f0000000040)=""/140) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) r3 = add_key(&(0x7f0000000200)='cifs.idmap\x00', &(0x7f0000000240)={0x73, 0x79, 0x7a, 0x0}, &(0x7f0000000380)="0a366236eb57b91264cffbe50720d58a7348553cb6a73f44358aadb90bcf8c3e4a7475ccfd529624e47e7e48f8d72f303c103a6a15fcd625c9ba2307625f9330d1d2d0ba6e7f33fd4274e5bd14c6cc56a78c876857104ca7ea361044dec0fc709171c5b81cabf4c09aa8128e0c8824251411d113ff6442be94e2ed3eba4221c0b478bfca753e3096e117a397f0ccd11ba664b40b18fa89", 0x97, 0xfffffffffffffff8) keyctl$revoke(0x3, r3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00403a400000f200001801000010000000000000000000000000000000000000002000000060bf2325688d319c822276ac6a", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) ioctl$sock_inet_SIOCGIFNETMASK(r2, 0x891b, &(0x7f0000000280)={'bond_slave_0\x00', {0x2, 0x4e24, @local}}) accept4$packet(r2, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000180)=0x14, 0x0) ioctl$sock_inet6_SIOCSIFADDR(r2, 0x8916, &(0x7f00000001c0)={@loopback, 0x78, r4}) [ 438.668742] binder: 14789:14792 ioctl c0306201 20000440 returned -14 [ 438.674971] binder_alloc: 14787: binder_alloc_buf failed to map page at 20001000 in userspace 03:36:46 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = dup3(r0, r0, 0x80000) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r1, 0x6, 0x1d, &(0x7f0000000000)={0x20, 0x0, 0x1, 0x7fff, 0x4}, 0x14) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 438.675478] binder: 14787:14790 transaction failed 29201/-12, size 0-0 line 3136 [ 438.679917] device lo entered promiscuous mode [ 438.681784] binder_alloc: binder_alloc_mmap_handler: 14787 20001000-20004000 already mapped failed -16 03:36:46 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000000)={0x2, 0x7, 0x8000, 0x4, 0x7ff}) r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer2\x00', 0x80, 0x0) ioctl$TIOCLINUX5(r1, 0x541c, &(0x7f0000000080)={0x5, 0x1ff, 0x3, 0x5317, 0xfc3e}) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(0xffffffffffffffff, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 438.681987] binder: BINDER_SET_CONTEXT_MGR already set [ 438.681994] binder: 14787:14799 ioctl 40046207 0 returned -16 [ 438.682242] binder_alloc: 14787: binder_alloc_buf, no vma 03:36:46 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) fcntl$getownex(r1, 0x10, &(0x7f0000000000)={0x0, 0x0}) sched_setparam(r2, &(0x7f0000000040)=0x3) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 438.682258] binder: 14787:14790 transaction failed 29189/-3, size 0-0 line 3136 [ 438.683447] binder: undelivered TRANSACTION_ERROR: 29189 [ 438.683509] binder: undelivered TRANSACTION_ERROR: 29201 [ 438.683922] device lo left promiscuous mode [ 438.741915] binder: 14802:14803 unknown command 1077559296 03:36:46 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r0, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000000)={{{@in=@multicast1, @in6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@multicast2}}, &(0x7f0000000140)=0xe8) setreuid(0x0, r1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 438.741924] binder: 14802:14803 ioctl c0306201 20000440 returned -22 [ 438.751169] binder: BINDER_SET_CONTEXT_MGR already set [ 438.751177] binder: 14802:14803 ioctl 40046207 0 returned -16 [ 438.752270] binder: 14802:14806 unknown command 1077559296 [ 438.752278] binder: 14802:14806 ioctl c0306201 20000440 returned -22 [ 438.818844] binder_alloc: 14809: binder_alloc_buf failed to map page at 20001000 in userspace 03:36:46 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) r2 = mmap$binder(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x2000000, 0x8010, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000380)={0x0}) r4 = mmap$binder(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x5, 0x110, r0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000600)={0x130, 0x0, &(0x7f0000000480)=[@reply={0x40406301, {0x2, 0x0, 0x4, 0x0, 0x10, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000080)=[@fd={0x66642a85, 0x0, r1, 0x0, 0x3}, @ptr={0x70742a85, 0x0, &(0x7f0000000000), 0x1, 0x2, 0x21}, @ptr={0x70742a85, 0x1, &(0x7f0000000040), 0x1, 0x4, 0x2e}], &(0x7f0000000140)=[0x28, 0x20, 0x70]}}, @transaction={0x40406300, {0x2, 0x0, 0x4, 0x0, 0x11, 0x0, 0x0, 0x58, 0x50, &(0x7f0000000180)=[@fda={0x66646185, 0x6, 0x2, 0x22}, @flat={0x73682a85, 0x10b, r2, 0x2}, @fda={0x66646185, 0x1, 0x0, 0x31}], &(0x7f0000000200)=[0x78, 0x40, 0x0, 0x48, 0x0, 0x0, 0x20, 0x38, 0x18, 0x48]}}, @transaction={0x40406300, {0x1, 0x0, 0x3, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8, &(0x7f0000000280), &(0x7f00000002c0)=[0x38]}}, @transaction={0x40406300, {0x1, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x30, 0x20, &(0x7f00000003c0)=[@flat={0x73622a85, 0x10b, r3, 0x4}, @flat={0x776a2a85, 0x10b, r4, 0x3}], &(0x7f0000000400)=[0x28, 0x0, 0x40, 0x18]}}, @increfs={0x40046304, 0x3}, @acquire={0x40046305, 0x4}, @release={0x40046306, 0x1}, @acquire={0x40046305, 0x2}], 0x2f, 0x0, &(0x7f00000005c0)="bc3d2c2a641b90eeaea3304cfdc9fefdc020fa2c99ecd7ea9420b75eda8f8d10e0962827e75c6e253b80798c648b81"}) madvise(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x2000800001) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003ca6", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 438.818903] binder: 14809:14812 transaction failed 29201/-12, size 0-0 line 3136 [ 438.821571] binder_alloc: binder_alloc_mmap_handler: 14809 20001000-20004000 already mapped failed -16 [ 438.821720] binder: BINDER_SET_CONTEXT_MGR already set [ 438.821728] binder: 14809:14813 ioctl 40046207 0 returned -16 [ 438.821843] binder_alloc: 14809: binder_alloc_buf, no vma [ 438.821861] binder: 14809:14812 transaction failed 29189/-3, size 0-0 line 3136 [ 438.822112] binder: undelivered TRANSACTION_ERROR: 29189 [ 438.822174] binder: undelivered TRANSACTION_ERROR: 29201 [ 438.853843] binder: 14817:14818 ioctl 801c581f 20000000 returned -22 [ 438.854586] binder: 14817:14818 transaction failed 29189/-22, size 0-0 line 3013 [ 438.855697] binder: 14817:14818 ioctl 801c581f 20000000 returned -22 [ 438.856926] binder: undelivered TRANSACTION_ERROR: 29189 03:36:46 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = creat(&(0x7f0000000080)='./file0\x00', 0x1) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sloppy_tcp\x00', 0x2, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000140)={{{@in=@multicast1, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}}}, &(0x7f00000000c0)=0xe8) ioprio_set$uid(0x3, r4, 0x1) openat(r3, &(0x7f0000000240)='./file0\x00', 0x1, 0x141) write$P9_RSYMLINK(r3, &(0x7f0000000040)={0x14, 0x11, 0x2, {0x10, 0x1, 0x7}}, 0x14) madvise(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:46 executing program 5: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, @perf_config_ext={0x3, 0x10000}, 0x0, 0x2000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/checkreqprot\x00', 0x80000, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000100), &(0x7f0000000140)=0x30) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) [ 438.891838] binder: 14821:14822 got transaction to context manager from process owning it [ 438.891852] binder: 14821:14822 transaction failed 29201/-22, size 0-0 line 3004 [ 438.902782] binder_alloc: binder_alloc_mmap_handler: 14821 20001000-20004000 already mapped failed -16 [ 438.910741] binder: BINDER_SET_CONTEXT_MGR already set [ 438.910750] binder: 14821:14823 ioctl 40046207 0 returned -16 [ 438.911165] binder: undelivered TRANSACTION_ERROR: 29201 03:36:47 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db10", 0x2) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:47 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x802) [ 438.980004] binder: BINDER_SET_CONTEXT_MGR already set [ 438.980012] binder: 14825:14826 ioctl 40046207 0 returned -16 [ 438.981962] device lo entered promiscuous mode [ 438.990780] device lo left promiscuous mode [ 439.008946] IPVS: Creating netns size=2536 id=104 [ 439.019336] binder: 14832:14834 got reply transaction with no transaction stack [ 439.019345] binder: 14832:14834 transaction failed 29201/-71, size 104-24 line 2921 [ 439.019794] binder_alloc: 14832: binder_alloc_buf size -6468294964810874880 failed, no address space [ 439.019801] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 439.019819] binder: 14832:14834 transaction failed 29201/-28, size 0--6468294964810874880 line 3136 [ 439.022755] binder_alloc: binder_alloc_mmap_handler: 14832 20001000-20004000 already mapped failed -16 [ 439.037245] binder: 14832:14835 got reply transaction with no transaction stack [ 439.037254] binder: 14832:14835 transaction failed 29201/-71, size 104-24 line 2921 [ 439.037361] binder: BINDER_SET_CONTEXT_MGR already set [ 439.037369] binder: 14832:14835 ioctl 40046207 0 returned -16 [ 439.037761] binder: undelivered TRANSACTION_ERROR: 29201 [ 439.037798] binder: undelivered TRANSACTION_ERROR: 29201 [ 439.037849] binder: undelivered TRANSACTION_ERROR: 29201 [ 439.097001] binder: BINDER_SET_CONTEXT_MGR already set [ 439.097010] binder: 14837:14839 ioctl 40046207 0 returned -16 [ 439.098005] binder: send failed reply for transaction 283 to 14837:14838 [ 439.102543] binder: undelivered TRANSACTION_COMPLETE [ 439.102550] binder: undelivered TRANSACTION_ERROR: 29189 [ 439.129763] device lo entered promiscuous mode [ 439.134312] device lo left promiscuous mode [ 439.203214] binder_alloc: 14845: binder_alloc_buf failed to map page at 20001000 in userspace [ 439.203246] binder: 14845:14846 transaction failed 29201/-12, size 0-0 line 3136 [ 439.209128] binder_alloc: binder_alloc_mmap_handler: 14845 20001000-20004000 already mapped failed -16 [ 439.214049] binder: BINDER_SET_CONTEXT_MGR already set [ 439.214058] binder: 14845:14847 ioctl 40046207 0 returned -16 [ 439.214181] binder_alloc: 14845: binder_alloc_buf, no vma [ 439.214199] binder: 14845:14846 transaction failed 29189/-3, size 0-0 line 3136 [ 439.214478] binder: undelivered TRANSACTION_ERROR: 29201 [ 439.214840] binder: undelivered TRANSACTION_ERROR: 29189 [ 439.373202] device lo entered promiscuous mode [ 439.376924] device lo left promiscuous mode [ 439.715323] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 439.728860] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 439.783756] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 439.797616] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 439.852563] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 439.867170] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 439.881492] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 439.897387] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 440.484219] IPVS: Creating netns size=2536 id=105 [ 440.615935] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 440.692284] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 440.698701] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 440.706107] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 440.838654] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 440.856766] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 440.947398] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 440.966228] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 441.055027] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 441.076661] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 441.094738] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 441.101779] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 441.109928] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 441.121095] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 441.128061] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 441.135808] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready 03:36:49 executing program 1: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140), 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:49 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x8912, &(0x7f0000000180)="025c3f0a00145f8f764070") r2 = socket$inet(0x10, 0x3, 0x0) sendmsg(r2, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000009ff0)=[{&(0x7f0000000880)="24000000280007031dfffd946fa2830020200a0009000000001d85680c1ba3a20400ff7e280000001100ffffba16a0aa1c0009b3ebea8653b1cc7e63975c0ac47b6268e3966cf055d90f15a3", 0x4c}], 0x1}, 0x0) r3 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r3, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r3, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:49 executing program 4: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140), 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) [ 441.207675] device lo entered promiscuous mode [ 441.214178] device lo left promiscuous mode 03:36:49 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:49 executing program 2: perf_event_open(&(0x7f0000000000)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000000, 0x0, 0x0, 0x0, 0x200, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, @perf_config_ext={0x3, 0x10000}, 0x0, 0x2000000000000000}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = openat$selinux_checkreqprot(0xffffffffffffff9c, &(0x7f0000000080)='/selinux/checkreqprot\x00', 0x80000, 0x0) getsockopt$IP_VS_SO_GET_DAEMON(r0, 0x0, 0x487, &(0x7f0000000100), &(0x7f0000000140)=0x30) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:36:49 executing program 3: mlockall(0x1) r0 = syz_open_dev$loop(&(0x7f0000000500)='/dev/loop#\x00', 0x7, 0x12040) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = creat(&(0x7f0000000280)='./file0\x00', 0x1) write$P9_RWALK(r3, &(0x7f00000002c0)={0x57, 0x6f, 0x2, {0x6, [{0x1a, 0x1}, {0x8, 0x0, 0x6}, {0x80, 0x4, 0x3}, {0x0, 0x3}, {0x1, 0x1, 0x3}, {0x38, 0x2, 0x6}]}}, 0x57) r4 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="3e8dc656f89085660000000000000000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000180)={'veth0_to_bridge\x00', 0x8000}) ioctl$BLKBSZSET(r6, 0x40081271, &(0x7f0000000380)=0x7ff) setsockopt$inet6_tcp_TLS_TX(r5, 0x6, 0x1, &(0x7f0000000340), 0x4) r7 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000480)='/dev/pktcdvd/control\x00', 0x82040, 0x0) ioctl$LOOP_SET_FD(r0, 0x4c00, r7) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r6, 0x404c534a, &(0x7f0000000400)={0x2, 0x3, 0x7}) 03:36:49 executing program 5: r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000040)=0x0) ptrace(0x421f, r2) r3 = openat$selinux_status(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/status\x00', 0x0, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f00000001c0)={0x0, @dev, @broadcast}, &(0x7f0000000240)=0xc) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000280)={'team0\x00', r4}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) writev(r3, &(0x7f0000000140)=[{&(0x7f0000000080)="1ec1cf1de217086cd8abaa7a0b68660cef6ceaf217d7b638acf141149636e5c3d593ec1ae121063d870e5cb2", 0x2c}, {&(0x7f00000002c0)="2bf5b378b511168ed0608cd70d1109ae840741848871e43cca9153c8bd61f3f397914d10b1f328cc26e7b48f4facd7bb8907a15bf31f302baf7b7c632fc7a4a0fb344b9b11bfc5ed698dcde14fc6ebc8e8e672b082efad040b88d6ec2c4fab93b10a0975bc74bfaf5b45dec520bbda461f434f131216c22fbc224ffc7bb0e58f9ce3eba27f94bc3faba7956e6bc97fcdfb6896243deae62f4cd4107993fa540c9b2fffb2db9f20ea894a64382a426fc1741b090450a84b6a5f43cf446ea5252607585466185d577b80ca82", 0xcb}], 0x2) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) [ 441.260572] netlink: 8 bytes leftover after parsing attributes in process `syz-executor7'. [ 441.299476] device lo left promiscuous mode 03:36:49 executing program 6: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r0, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) sendfile(r0, r0, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 441.306697] binder_alloc: 15338: binder_alloc_buf failed to map page at 20001000 in userspace [ 441.306729] binder: 15338:15339 transaction failed 29201/-12, size 0-0 line 3136 [ 441.307167] binder: 15341:15343 ioctl c0306201 20000440 returned -14 03:36:49 executing program 6: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r0, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) sendfile(r0, r0, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 441.404406] binder_alloc: binder_alloc_mmap_handler: 15338 20001000-20004000 already mapped failed -16 [ 441.404737] binder: BINDER_SET_CONTEXT_MGR already set [ 441.404745] binder: 15338:15359 ioctl 40046207 0 returned -16 [ 441.405537] binder: undelivered TRANSACTION_ERROR: 29201 03:36:49 executing program 6: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r0, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) sendfile(r0, r0, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:49 executing program 6: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:36:49 executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) [ 441.660698] binder: 15369:15370 ioctl c0306201 20000440 returned -14 03:36:49 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="006340400000000000000000000000000000000000000000000000000000000000000100000000000000f6247d6e3a05ca670829570000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 441.785891] netlink: 8 bytes leftover after parsing attributes in process `syz-executor7'. [ 441.797030] device lo entered promiscuous mode [ 441.808853] device lo left promiscuous mode 03:36:49 executing program 2: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) [ 441.846676] binder_alloc: 15377: binder_alloc_buf size 5620043502373727872 failed, no address space [ 441.885628] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 441.917152] binder: 15377:15379 transaction failed 29201/-28, size 2663316229636227072-2956727272737500797 line 3136 [ 441.973517] binder_alloc: binder_alloc_mmap_handler: 15377 20001000-20004000 already mapped failed -16 [ 441.997863] binder: BINDER_SET_CONTEXT_MGR already set [ 442.009276] binder: 15377:15386 ioctl 40046207 0 returned -16 [ 442.025328] binder: undelivered TRANSACTION_ERROR: 29201 [ 442.093771] device lo entered promiscuous mode [ 442.116952] device lo left promiscuous mode [ 442.928125] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 442.962356] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 442.968483] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 442.975999] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:36:51 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db10", 0x2) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:51 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = openat$pktcdvd(0xffffffffffffff9c, &(0x7f0000000080)='/dev/pktcdvd/control\x00', 0x4001, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f00000000c0)={0x0, 0x0}, &(0x7f0000000140)=0xc) fstat(r0, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000200)={0x0, 0x0}, &(0x7f0000000240)=0xc) write$P9_RSTATu(r2, &(0x7f0000000380)={0x8f, 0x7d, 0x2, {{0x0, 0x6d, 0x20, 0x7fffffff, {0x40, 0x3, 0x3}, 0x4000000, 0x5, 0x2, 0x4, 0xd, '/dev/binder#\x00', 0x1, '*', 0x21, 'em0eth0\'cpuset%*posix_acl_access\x00', 0xb, '*[wlan1self'}, 0xd, '/dev/binder#\x00', r3, r4, r5}}, 0x8f) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x76, 0x0, &(0x7f0000000000)="9d1d071d4575e0f77b5ac5220d4f17668a181c277a0f6e2cb9f1a9f64493b7665011b1043c7bd2e940e03726476913c4b5faa1b1db5382dca4cc86d42174623a2745a80a312fe23b113991fc38fdfef5d592c90217dc63653f58eb2a38fe3ab65ce4e88289518ca7f10dbf7844579567edfa26e19962"}) 03:36:51 executing program 1: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:51 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f00000002c0)='/dev/loop#\x00', 0x400000000000003, 0xffffffffffffffff) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) [ 444.018563] binder_alloc: 15654: binder_alloc_buf failed to map page at 20001000 in userspace [ 444.027582] binder: 15654:15655 transaction failed 29201/-12, size 0-0 line 3136 [ 444.037533] binder: BINDER_SET_CONTEXT_MGR already set [ 444.042985] binder_alloc: 15654: binder_alloc_buf, no vma [ 444.049478] binder: 15654:15655 ioctl 40046207 0 returned -16 [ 444.055511] binder: 15654:15657 transaction failed 29189/-3, size 0-0 line 3136 [ 444.469396] IPVS: Creating netns size=2536 id=106 [ 444.646133] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 444.661456] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 444.760940] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 444.774591] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 444.833314] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 444.849340] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 444.862938] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 444.913698] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 446.130485] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 446.166238] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 446.172357] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 446.179834] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:36:55 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) clock_gettime(0x0, &(0x7f0000000180)={0x0, 0x0}) utimes(&(0x7f0000000040)='./file0\x00', &(0x7f0000000240)={{r1, r2/1000+30000}, {0x0, 0x7530}}) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) 03:36:55 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f0000000040)={'mangle\x00', 0x3, [{}, {}, {}]}, 0x58) 03:36:55 executing program 6: r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:55 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000000)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:55 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = mmap$binder(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x1000002, 0x10, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={r1}) r2 = getpid() fcntl$lock(r0, 0x7, &(0x7f0000000000)={0x2, 0x1, 0xffffffffffffff71, 0x3, r2}) r3 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r3, &(0x7f0000000080)="020000000000884e910f2e6e070fdcd20000b0", 0x13) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x4, 0x11, r3, 0x0) sendfile(r3, r3, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:36:55 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:36:55 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) ioctl$SG_SET_DEBUG(r4, 0x227e, &(0x7f0000000200)) [ 447.266712] device lo entered promiscuous mode [ 447.277877] device lo left promiscuous mode [ 447.326823] binder_alloc: 16041: binder_alloc_buf failed to map page at 20001000 in userspace [ 447.369906] binder: 16041:16042 transaction failed 29201/-12, size 0-0 line 3136 [ 447.406790] binder_alloc: binder_alloc_mmap_handler: 16041 20001000-20004000 already mapped failed -16 03:36:55 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00s@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 447.437231] binder: BINDER_SET_CONTEXT_MGR already set [ 447.454063] binder: 16041:16048 ioctl 40046207 0 returned -16 [ 447.470393] binder: undelivered TRANSACTION_ERROR: 29201 [ 447.514213] binder: 16053:16054 unknown command 1077965568 [ 447.524565] binder: 16053:16054 ioctl c0306201 20000440 returned -22 [ 447.545117] binder_alloc: binder_alloc_mmap_handler: 16053 20001000-20004000 already mapped failed -16 [ 447.560645] binder: BINDER_SET_CONTEXT_MGR already set 03:36:55 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x2, 0x2009e, r0, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x4) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:55 executing program 5: r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x7, 0x0, 0x100000000, 0x0, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xdaa2, 0x0, 0x2000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ftruncate(r0, 0x80000000) syz_open_dev$loop(&(0x7f0000000000)='/dev/loop#\x00', 0x400fffffffd, 0x0) r1 = socket$inet6(0xa, 0x4, 0x0) accept4$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2}, &(0x7f0000000140)=0x1c, 0x80000) openat$urandom(0xffffffffffffff9c, &(0x7f0000000040)='/dev/urandom\x00', 0x41c440, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000080)={'\x00', 0x1a00}) ioctl$sock_inet_SIOCGIFPFLAGS(r2, 0x8935, &(0x7f00000001c0)={'bond_slave_1\x00'}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0x3}) [ 447.569899] device lo entered promiscuous mode [ 447.594940] binder: 16053:16055 ioctl 40046207 0 returned -16 03:36:55 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x9, 0x224000) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000640)=ANY=[@ANYBLOB="90000000000000000000000b000007000066ce656d316e6f246576656d31000000000000000000000000000000e7c80eed78c64fb894cac0954cb29f2c000000000000619fcd381e1089b3e84551f18c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc632d75736574636772007570246367726f7b9039826ed737ba1744b7677f577ef5f70f0749cd4aafdf426af865e8edaf3c449a0a8c28b67dd372da16e35e8bf752ff927c1a96b77d4b122638fd5e2fe4fc66a0536552f1cb546b9e6bcbdd9110358707ee9af9b56d1fdcb59ae92f1f8aa7140ae209811461826fb82e7607f97015bfc1614fecd69839e9372454e5fd3d14edf3c8ea06f04a634b9700000000000000000000000000000000"], 0x90) [ 447.659355] binder_alloc: 16059: binder_alloc_buf, no vma [ 447.671831] binder: 16059:16060 transaction failed 29189/-3, size 0-0 line 3136 [ 447.696548] binder: BINDER_SET_CONTEXT_MGR already set 03:36:55 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r1, 0x1, 0x1f, &(0x7f0000001240)=""/82, &(0x7f00000012c0)=0x52) r2 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r4 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x4a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r4, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r5) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r2) [ 447.707536] binder: 16059:16067 ioctl 40046207 0 returned -16 03:36:55 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000000)={'team0\x00', 0x0}) setsockopt$inet_pktinfo(r2, 0x0, 0x8, &(0x7f0000000040)={r3, @local, @broadcast}, 0xc) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="00634040000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 03:36:55 executing program 5: r0 = add_key$user(&(0x7f0000000080)='user\x00', &(0x7f0000000140)={0x73, 0x79, 0x7a, 0x1}, &(0x7f0000000240)="8b4a411e56694e9a27fc4c0b7a8ff5307686c899044b0528eb0d916d5ce4ac5ff523f007fa71b3e3b45bfd598fa85a2375b62fbb26c8698eebf77c108f5a9b934abe8f059d731613b69f5244179a7bf7fbe24fab9a9c96201dc149778e5559bc606656f0baee86f36aad45a9a25a0d9c34882adf62526ecd0a76d1f52c1cde7946b74e557a0383e85029ea68f9c810c552a05c09bb392ef20c5e014370171c86bb649ec01311b9370691a24c2e962756", 0xb0, 0xfffffffffffffff8) keyctl$assume_authority(0x10, r0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000040)={"6c6f00000000000000000000000200"}) ioctl$sock_SIOCADDDLCI(r1, 0x8980, &(0x7f0000000000)={'irlan0\x00', 0x5}) [ 447.737795] binder: undelivered TRANSACTION_ERROR: 29189 [ 447.755840] device lo left promiscuous mode [ 447.801977] binder: 16080:16083 ioctl 8933 20000000 returned -22 [ 447.829658] binder_alloc: 16080: binder_alloc_buf failed to map page at 20001000 in userspace [ 447.839747] device lo entered promiscuous mode [ 447.840203] device lo left promiscuous mode [ 447.869061] binder: 16080:16083 transaction failed 29201/-12, size 0-0 line 3136 [ 447.905404] binder_alloc: binder_alloc_mmap_handler: 16080 20001000-20004000 already mapped failed -16 [ 447.916445] binder: 16080:16083 ioctl 8933 20000000 returned -22 [ 447.922959] binder: BINDER_SET_CONTEXT_MGR already set [ 447.922968] binder: 16080:16089 ioctl 40046207 0 returned -16 [ 447.928511] binder_alloc: 16080: binder_alloc_buf, no vma [ 447.928532] binder: 16080:16091 transaction failed 29189/-3, size 0-0 line 3136 [ 447.928897] binder: undelivered TRANSACTION_ERROR: 29189 [ 447.928960] binder: undelivered TRANSACTION_ERROR: 29201 [ 448.095984] device lo entered promiscuous mode [ 448.103005] device lo left promiscuous mode [ 448.960196] IPVS: Creating netns size=2536 id=107 [ 448.994504] IPVS: Creating netns size=2536 id=108 [ 449.022593] IPVS: Creating netns size=2536 id=109 [ 449.060766] IPVS: Creating netns size=2536 id=110 [ 449.927099] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 449.952315] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 450.038428] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 450.054466] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 450.090659] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 450.110121] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 450.159954] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 450.208874] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 450.223912] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 450.244357] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 450.297189] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 450.326566] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 450.371955] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 450.427516] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 450.453010] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 450.483527] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 450.503932] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 450.517432] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 450.528090] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 450.554251] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 450.564855] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 450.573494] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 450.587806] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 450.603461] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 450.614461] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 450.626791] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 450.643560] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 450.682373] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 450.697637] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 450.731358] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 450.757355] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 450.770507] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 450.796809] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 450.808493] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 450.850620] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 450.858529] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 450.869514] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 450.879723] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 450.887967] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 450.896250] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 451.774990] IPVS: Creating netns size=2536 id=111 [ 452.493954] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 452.540500] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 452.741607] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 452.781423] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 452.990660] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 453.031690] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 453.083236] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 453.117972] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 453.198607] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 453.323015] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 453.341108] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 453.348484] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 453.355546] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 453.365542] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 453.465521] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 453.475259] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 453.482358] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 453.490762] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 453.497908] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 453.508650] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 453.522096] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 453.639434] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 453.657100] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 453.663804] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 454.938124] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 454.978903] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 454.985028] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 454.992513] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:37:02 executing program 7: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x181100, 0x0) ioctl$BLKRRPART(r0, 0x125f, 0x0) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r2, 0x0) madvise(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='\x00c@@\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 03:37:02 executing program 5: r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$PERF_EVENT_IOC_PAUSE_OUTPUT(r0, 0x40042409, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x800, 0x0) ioctl$IOC_PR_REGISTER(r1, 0x401870c8, &(0x7f0000000040)={0x3, 0x6}) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'lo\x00@\x00', 0x101}) 03:37:02 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f0000000040)={'mangle\x00', 0x3, [{}, {}, {}]}, 0x58) 03:37:02 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b000000e5ff"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) [ 455.153826] binder_alloc: 17936: binder_alloc_buf size 274878185472 failed, no address space [ 455.169973] binder_alloc: allocated: 0 (num: 0 largest: 0), free: 12288 (num: 1 largest: 12288) [ 455.183296] device lo entered promiscuous mode [ 455.190254] device lo left promiscuous mode [ 455.222291] binder: 17936:17939 transaction failed 29201/-28, size 137439084544-137439100928 line 3136 03:37:03 executing program 6: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f0000000040)={'mangle\x00', 0x3, [{}, {}, {}]}, 0x58) 03:37:03 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x5, 0x4) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'\x00', 0x1000}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) [ 455.245870] binder_alloc: binder_alloc_mmap_handler: 17936 20001000-20004000 already mapped failed -16 [ 455.258989] binder: BINDER_SET_CONTEXT_MGR already set [ 455.264281] binder: 17936:17955 ioctl 40046207 0 returned -16 [ 455.279933] binder_alloc: 17936: binder_alloc_buf, no vma [ 455.280305] binder: undelivered TRANSACTION_ERROR: 29201 [ 455.293356] binder: 17936:17939 transaction failed 29189/-3, size 137439084544-137439100928 line 3136 [ 455.317560] binder: undelivered TRANSACTION_ERROR: 29189 [ 455.320770] device lo entered promiscuous mode [ 455.323203] device lo left promiscuous mode 03:37:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) recvfrom(r1, &(0x7f0000000940)=""/202, 0xca, 0x800040, &(0x7f0000000140)=@vsock={0x28, 0x0, 0x2711, @my=0x0}, 0x80) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000300)=0x0) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000580)=r2) r3 = mmap$binder(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x1, 0x88010, r0, 0x0) r4 = mmap$binder(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3000004, 0x81ea932ae0b231d, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r1, 0xc018620b, &(0x7f0000000240)={0x0}) r6 = mmap$binder(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x8, 0x140110, r0, 0x50) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000400)={0xe0, 0x0, &(0x7f0000000480)=[@register_looper, @reply={0x40406301, {0x4, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x18, 0x8, &(0x7f00000001c0)=[@flat={0x77622a85, 0x1, r3, 0x3}], &(0x7f0000000200)=[0x38]}}, @request_death={0x400c630e, 0x2, 0x3}, @register_looper, @free_buffer={0x40086303, r4}, @increfs_done={0x40106308, r5, 0x1}, @transaction={0x40406300, {0x3, 0x0, 0x2, 0x0, 0x10, 0x0, 0x0, 0x0, 0x10, &(0x7f0000000300), &(0x7f0000000340)=[0x78, 0x0]}}, @acquire_done={0x40106309, r6}, @exit_looper, @decrefs={0x40046307, 0x3}], 0x7a, 0x0, &(0x7f0000000380)="32a8da63721ebe4d90b52ab1319d47006af947a6270594552706b76ee0076e2677d1ee18e87e3cd3b97ca19a2c8100315386aeb80bf026e4504287067358b7ab3dbe6c80b4ff0c9f6d1c8c0179607e01a08358cbffb5fc94f44237ccfdf1854dd8771f52b8c27b8e6c5d68fbcc1db6aa80eb2a2abea190222d91"}) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) pwritev(r1, &(0x7f0000000800)=[{&(0x7f00000005c0)="cf25bcb6f62eb97438dce2b5ad621e561b77541eb4ffbff560bb1e224e8142bda847ab029c3cba353ac71992de5a55c371ac660df8c7089e03aa912a03e91a20d1e0ff421d83cb16d9c2ab810279edfba538b5bc46f2ece89087ad6a2ad75b89b31dea35e4f4dd6003b2548ba4900347a4fc373d1f683fc3f0150192c7e89bd91d470c10c9389f703d3bc7577e9062d2f1517c95ecdfb100cf71977ad7c18b80a9983bd62c86de14351647f784fdbc9647b15b3df55f1e94f8c960de5b272595b5ca9d445ebdaf1d6aa7279e3704a87ec66790ed", 0xd4}, {&(0x7f00000006c0)="300a33e1bd2943e0686ad39fffb043c96e21928caddbecb05eb4ebcd62f3e27cee25a4b62cb67b6ae001", 0x2a}, {&(0x7f0000000700)="7165fec5a8487081bc81d11094415c8533dd49b75c135c810abf4e76ebd37ae413b111825ec2801b52312a16d0868a9307ef32f069abeb7ff936b7d1513fa1b5d70ebce64307922e30cbe7fe8634ae495955549aac16e13389e982de0d38f48b0f9909bb4faa7020324d59bb067c2431f820a66bab44f5b25af21dbd65bf29112fdc3b39639788e49a3f64dbc6ee408516fecbb1a35a0ce26bedfe968c33e01a7c4677958c5c50e850684b126e90f3c1126e7f07e95133f363d7adaeaeed348fb2c5363c06459a8c1f87e51396069d24f015154cd6", 0xd5}], 0x3, 0x0) write$binfmt_script(r0, &(0x7f0000000080)={'#! ', './file0', [{}, {0x20, '/dev/binder#\x00'}], 0xa, "570de78105a28b5e2d80d2555a6aff4f840e0fe5f3c4e9364ca03529af48a9c498c9b1af658f4381cf9b79aec4cf33955d61a1e60b0e45384d7281d76b8f1e28a343d76642190f9e287ffc97cf3fc8348196c77d1cb8646e67eb92326c95d7c239637e1de3fe537a40a79c22"}, 0x86) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$TIOCMBIC(r1, 0x5417, &(0x7f0000000040)=0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:37:03 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r1, 0x29, 0x41, &(0x7f0000000040)={'mangle\x00', 0x3, [{}, {}, {}]}, 0x58) 03:37:03 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write$P9_RCREATE(r0, &(0x7f0000000040)={0x18, 0x73, 0x2, {{0x1, 0x2, 0x6}, 0x9}}, 0x18) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:37:03 executing program 6: r0 = socket(0x2000000011, 0x3, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ppp\x00', 0x50400, 0x0) ioctl$sock_SIOCBRDELBR(r0, 0x89a1, &(0x7f00000000c0)='veth0_to_team\x00') r2 = userfaultfd(0x800) r3 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/sys/net/ipv4/vs/schedule_icmp\x00', 0x2, 0x0) ioctl$INOTIFY_IOC_SETNEXTWD(r3, 0x40044900, 0x9) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1}) ioctl$FICLONERANGE(0xffffffffffffffff, 0x4020940d, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x81}) sendto$inet6(r0, &(0x7f0000000040), 0xfe69, 0x0, &(0x7f0000000140)={0xa, 0x8100, 0x1, @ipv4={[], [], @multicast2}}, 0x1c) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000001c0)={{{@in=@multicast2, @in6=@loopback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@loopback}, 0x0, @in6}}, &(0x7f00000002c0)=0xe8) syz_open_pts(r3, 0x600000) ioctl$sock_ifreq(r1, 0x89ff, &(0x7f0000000300)={'bridge0\x00', @ifru_addrs=@hci={0x1f, r4}}) 03:37:03 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) splice(r0, &(0x7f0000000000), r1, &(0x7f0000000040), 0x0, 0x8) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:37:03 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) r1 = accept4$packet(0xffffffffffffffff, 0x0, &(0x7f0000000040), 0x80800) setsockopt$packet_tx_ring(r1, 0x107, 0xd, &(0x7f0000000180)=@req3={0x5, 0xfffffffffffff801, 0x8, 0xffffffff, 0xfff, 0xffff, 0xffff}, 0x1c) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) 03:37:03 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}, 0x1, 0x0, 0x0, 0x1}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:37:03 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) [ 455.474192] binder: 18002:18003 ioctl c0306201 20000440 returned -14 [ 455.482372] binder: 18002:18004 ioctl c018620b 20000040 returned -14 [ 455.490238] binder: 18002:18003 ioctl c0306201 20000440 returned -14 03:37:03 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = dup(r1) ioctl$EVIOCSREP(r2, 0x40084503, &(0x7f0000000000)=[0x2, 0xa0d8]) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="0063400012300000000000000000000000000d090000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) 03:37:03 executing program 6: madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x0) mremap(&(0x7f00003f6000/0xf000)=nil, 0xf000, 0x4000, 0x0, &(0x7f000028d000/0x4000)=nil) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/validatetrans\x00', 0x1, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) 03:37:03 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f00000002c0)={0xcc, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="2ca3a421d23f0d717aafee2c397a28cde09db62d5c8fe6d5bd5cc9d15a43ed58c97c8b8512b7dd02c4ca583b54b57b447b0652f1749ad85ac0a5826caa3e5b49979cca9d9b83a7e3f2cd21db19dd5cf7fd2c97a2e1eb5ed100f4788471aecf63dbbc9468b61e559c3e2ac112c9647934973e0163ce28440888cbee46c246c26ab8b68d0a1cdec87066f956dd0abda17a77874284c523879d2c49768582cef12d498c52f33efd9bb47e84a5f8fae92272c7d430ac617e3dceedd6fe30ac632c58d16b77666e0616dc41d9cdc2ffd46da8e3d2", @ANYRES64=r1, @ANYBLOB="ba9607aba465ad3b45496947de6031a14e37bf78400235fc2115d67dbe670ba8bab03bc655e305bcdb1efa505e1444cb21f418400ad1c7e461ddfc0772f14819f2c6f0d45e751fce342dbf14d21578e6be864d62c4", @ANYRES32=r1, @ANYRES32=r0, @ANYRESHEX=r0], 0xfffffffffffffced, 0x0, &(0x7f0000000300)="1112cd22ee8be1989862ef556d135583dcd8901bc60a3e4ba1c0ee4abfaa08a7ad51c8408e743dfdfbbac47ee2a7cdec3223c32f8ff3a608b01950fe7b4d6ad3fade76eb391805a4b444799cd40a01af531def3267c90d9a6502fcfa2539dad5211bf6c91cd147679534b71225092c02265286a0636fdae6312e9bd27911e73612b9e996530e03fe8a94e04e01b3159bb5c3"}) [ 455.528962] device lo entered promiscuous mode [ 455.546716] binder_alloc: 18008: binder_alloc_buf failed to map page at 20001000 in userspace [ 455.546748] binder: 18008:18020 transaction failed 29201/-12, size 0-0 line 3136 03:37:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) r2 = socket$packet(0x11, 0x3, 0x300) finit_module(r2, &(0x7f0000000040)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) mmap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x4, 0x1010, r0, 0x2) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:37:03 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGPGRP(0xffffffffffffff9c, 0x8904, &(0x7f0000000040)=0x0) tkill(r2, 0x3b) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) umount2(&(0x7f0000000000)='./file0\x00', 0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0063404000007ebb293d04af5c000000000000000000000029503d000000003c1a0515d44808eadbdeff44b6000000000000000000000000000000000000000000000000", @ANYPTR=&(0x7f0000000200)=ANY=[], @ANYPTR=&(0x7f0000000240)=ANY=[]], 0x0, 0x0, &(0x7f00000003c0)}) [ 455.548340] binder_alloc: binder_alloc_mmap_handler: 18008 20001000-20004000 already mapped failed -16 [ 455.548493] binder: BINDER_SET_CONTEXT_MGR already set 03:37:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) getsockopt$EBT_SO_GET_INIT_ENTRIES(r1, 0x0, 0x83, &(0x7f00000001c0)={'filter\x00', 0x0, 0x3, 0xa7, [], 0x9, &(0x7f0000000040)=[{}, {}, {}, {}, {}, {}, {}, {}, {}], &(0x7f0000000100)=""/167}, &(0x7f0000000240)=0x78) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:37:03 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) [ 455.548509] binder: 18008:18020 ioctl 40046207 0 returned -16 [ 455.548680] binder_alloc: 18008: binder_alloc_buf, no vma [ 455.548697] binder: 18008:18024 transaction failed 29189/-3, size 0-0 line 3136 03:37:03 executing program 4: r0 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000280)='/proc/self/net/pfkey\x00', 0x2, 0x0) ioctl$PERF_EVENT_IOC_ID(r0, 0x80082407, &(0x7f0000000300)) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) r2 = open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f0000002000), 0x1000) read$FUSE(r1, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$EVIOCSREP(r2, 0x40084503, &(0x7f0000000040)=[0x7ffe, 0x80000001]) write$FUSE_DIRENT(r2, &(0x7f0000000240)=ANY=[@ANYRESDEC=r3], 0x14) write$FUSE_IOCTL(r1, &(0x7f0000000180)={0x20, 0xffffffffffffffda, 0x3, {0x2, 0x0, 0x4, 0x80}}, 0x20) 03:37:03 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = openat$selinux_avc_cache_stats(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_stats\x00', 0x0, 0x0) ioctl$sock_SIOCINQ(r1, 0x541b, &(0x7f0000000040)) ioctl$IOC_PR_REGISTER(r1, 0x401870c8, &(0x7f0000000100)={0x2, 0x5}) r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) getsockopt$inet_int(r2, 0x0, 0x16, &(0x7f00000001c0), &(0x7f0000000200)=0x4) ioctl$BLKRAGET(r2, 0x1263, &(0x7f0000000140)) write(r2, &(0x7f0000000000)="a85883156f794c05e0b0", 0x384) ioctl$BLKROTATIONAL(r0, 0x127e, &(0x7f0000000080)) syz_genetlink_get_family_id$ipvs(&(0x7f0000000180)='IPVS\x00') mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r2, 0x8918, &(0x7f0000000480)={'veth0_to_bond\x00', {0x2, 0x4e22, @rand_addr=0xfff}}) sendfile(r2, r2, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000140), 0x0, 0x0, &(0x7f00000003c0)}) [ 455.548989] binder: undelivered TRANSACTION_ERROR: 29189 [ 455.549049] binder: undelivered TRANSACTION_ERROR: 29201 [ 455.575985] binder: 18025:18028 ioctl 40084503 20000000 returned -22 [ 455.576594] binder: 18025:18028 unknown command 4219648 [ 455.576602] binder: 18025:18028 ioctl c0306201 20000440 returned -22 [ 455.577654] binder: 18025:18028 ioctl 40084503 20000000 returned -22 [ 455.577897] binder: BINDER_SET_CONTEXT_MGR already set [ 455.577905] binder: 18025:18030 ioctl 40046207 0 returned -16 [ 455.582322] binder: 18006:18017 ioctl c0306201 20000440 returned -14 [ 455.588872] binder: 18006:18032 ioctl c0306201 20000440 returned -14 [ 455.624826] binder: 18039:18041 unknown command 564437804 [ 455.624834] binder: 18039:18041 ioctl c0306201 200002c0 returned -22 [ 455.630577] binder_alloc: binder_alloc_mmap_handler: 18039 20001000-20004000 already mapped failed -16 [ 455.632100] binder: BINDER_SET_CONTEXT_MGR already set [ 455.632108] binder: 18039:18045 ioctl 40046207 0 returned -16 [ 455.632199] binder: 18039:18045 unknown command 564437804 [ 455.632207] binder: 18039:18045 ioctl c0306201 200002c0 returned -22 [ 455.669610] binder: 18050:18053 got transaction to invalid handle [ 455.669620] binder: 18050:18053 transaction failed 29201/-22, size -5312840327752972216-0 line 3013 [ 455.678259] binder: BINDER_SET_CONTEXT_MGR already set [ 455.678268] binder: 18050:18055 ioctl 40046207 0 returned -16 [ 455.681004] binder: 18050:18058 got transaction to invalid handle [ 455.681018] binder: 18050:18058 transaction failed 29201/-22, size -5312840327752972216-0 line 3013 [ 455.681398] binder: undelivered TRANSACTION_ERROR: 29201 [ 455.681463] binder: undelivered TRANSACTION_ERROR: 29201 [ 455.728194] binder: 18056:18059 ioctl c0306201 20000440 returned -14 [ 455.729368] binder: 18056:18064 ioctl c0306201 20000440 returned -14 [ 455.731892] binder: BINDER_SET_CONTEXT_MGR already set [ 455.731900] binder: 18061:18063 ioctl 40046207 0 returned -16 [ 455.732322] binder: 18061:18063 got transaction to context manager from process owning it [ 455.732335] binder: 18061:18063 transaction failed 29201/-22, size 0-0 line 3004 [ 455.732990] binder: BINDER_SET_CONTEXT_MGR already set [ 455.732998] binder: 18061:18063 ioctl 40046207 0 returned -16 [ 455.738266] binder: BINDER_SET_CONTEXT_MGR already set [ 455.738274] binder: 18061:18065 ioctl 40046207 0 returned -16 [ 455.750320] binder_alloc: 18061: binder_alloc_buf, no vma [ 455.750342] binder: 18061:18066 transaction failed 29189/-3, size 0-0 line 3136 [ 455.750631] binder: undelivered TRANSACTION_ERROR: 29189 [ 455.750687] binder: undelivered TRANSACTION_ERROR: 29201 [ 455.760845] binder: 18068:18069 ioctl 127e 20000080 returned -22 [ 455.767726] binder: 18068:18069 ioctl c0306201 20000440 returned -14 [ 455.788600] binder: 18068:18071 ioctl 127e 20000080 returned -22 [ 455.789855] binder: 18068:18071 ioctl c0306201 20000440 returned -14 [ 456.060976] device lo entered promiscuous mode 03:37:03 executing program 1: r0 = fcntl$getown(0xffffffffffffffff, 0x9) r1 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r1, 0x100000, &(0x7f0000000280)="0a951200000000b7de50707697a297457cac41cc52ecf43ef9cfcc41f8c7fdd9fad78e5f3e8ddfe216acc7a6181d5ae2b7b809eb88815bd1778684cadf8d17487ab14edfc8aa1140a8585bae22bfebdda168cb9dc4905ae50ca6cfbf9814cc8e9f688a2a4ec96889f8363d58525db44f4e1147fbacad43bc53029d8985094c62a2ba451f517dfd042daf630ed3dc7113255b7a5afde32d0900000000000000d2ada4835b4f520366797d05e8ba77f3be0245ccf65a0e8d20dd4089ceaaf31f") unlink(&(0x7f0000000040)='./file0\x00') perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) preadv(r1, &(0x7f0000000440)=[{&(0x7f0000000340)=""/202, 0xca}, {&(0x7f0000000540)=""/242, 0xf2}, {&(0x7f00000001c0)=""/94, 0x5e}, {&(0x7f0000000640)=""/251, 0xfb}, {&(0x7f0000000740)=""/172, 0xac}], 0x5, 0x0) syz_mount_image$f2fs(&(0x7f0000000180)='f2fs\x00', &(0x7f0000000240)='./file0\x00', 0x0, 0x0, &(0x7f00000008c0), 0x1003, &(0x7f0000000540)=ANY=[]) syz_mount_image$btrfs(&(0x7f0000000040)='btrfs\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x0, &(0x7f0000000100), 0x0, &(0x7f0000000140)=ANY=[]) perf_event_open(&(0x7f00000004c0)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$ASHMEM_GET_PIN_STATUS(0xffffffffffffffff, 0x7709, 0x0) r2 = syz_open_dev$sndseq(&(0x7f0000000080)='/dev/snd/seq\x00', 0x0, 0x0) syz_open_procfs(r0, &(0x7f00000000c0)='fd/4\x00') r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f000085dff0)='/dev/sequencer2\x00', 0x10000080002, 0x0) dup2(r2, r3) [ 456.084223] device lo left promiscuous mode [ 456.090527] device lo left promiscuous mode [ 456.183746] device lo entered promiscuous mode [ 456.191109] device lo left promiscuous mode 03:37:04 executing program 5: r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/vga_arbiter\x00', 0x200000, 0x0) epoll_wait(r1, &(0x7f0000000240)=[{}, {}], 0x2, 0x200) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000000)=[{0xe, 0x9}, {0x4, 0x3f}, {0x4, 0x1ffc}], 0x3) fcntl$F_GET_FILE_RW_HINT(r0, 0x40d, &(0x7f0000000040)) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r2, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) r3 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x84002, 0x88) mkdirat$cgroup(r1, &(0x7f0000000140)='syz0\x00', 0x1ff) write$FUSE_NOTIFY_INVAL_ENTRY(r3, &(0x7f0000000280)=ANY=[@ANYBLOB="31000000030000ff000027000000000000007976626f7890ae7875e7d06e657430776c0000000000000000000000000000a88ec15078cc845e57982d890d9ffaac807344333f99c555d961d494bde04467eac1c76ad39503391ca2bd34cd2a0a80f351c2ead14f517e04f49fa539fa591ad3cdac0ee4ff46605bd7192446324caeecab1e29f970efe3b6e40f8ba621230e441caba3b3bc11dfc494cba31ace3e3e9d50ebf8b67dbf2d7cd6f65ed97b22c5ce6c81479b52f2ee221689c347548b39ac32c4176d8d68bd86342bb6fa96423744493dd0f1e1a8c1046ef5803cb55894b6481d425c60a5b84b144ca5c093786194746132b886dbbe4678349ff80f457f0b0ef108"], 0x31) 03:37:04 executing program 7: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) sched_yield() madvise(&(0x7f0000002000/0x4000)=nil, 0x4000, 0x1) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x44, 0x0, &(0x7f0000000300)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200), &(0x7f0000000240)}}], 0x0, 0x0, &(0x7f00000003c0)}) 03:37:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r1, 0xc0505405, &(0x7f0000000040)={{0x1, 0x0, 0xd1, 0x1, 0x1}, 0x6, 0x1, 0xffffffff00000001}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$TIOCLINUX4(r1, 0x541c, &(0x7f0000000140)) 03:37:04 executing program 6: madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x0) mremap(&(0x7f00003f6000/0xf000)=nil, 0xf000, 0x4000, 0x0, &(0x7f000028d000/0x4000)=nil) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f00000001c0), 0xfffffef3) openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/validatetrans\x00', 0x1, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) read(r0, &(0x7f0000000200)=""/250, 0x50c7e3e3) 03:37:04 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:37:04 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) openat$md(0xffffffffffffff9c, &(0x7f0000000200)='/dev/md0\x00', 0x200800, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="030000000000000008001b0000000000bf04230ce2735b1c67b3268a8d08359832813e60c63ce482d7841e26c9aead05319ef386f1a617d31c764c2485d37b26a58f1f1518aae08889f00542df5773860e8cbeb7d38c3c573d2e293d21d32b2848f2b93be272fd2d10441da651cf0b85ff1df6bf1f14e737a09ecd5dadf024362b80ae617bc0ca8ed93ad1e0b823b70324a92b2ea2f8dde13d960ad04d6f27cf14305a81"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = gettid() r5 = syz_open_procfs(r4, &(0x7f0000000280)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r5) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) ioctl$UFFDIO_UNREGISTER(r5, 0x8010aa01, &(0x7f0000000180)={&(0x7f0000ffd000/0x1000)=nil, 0x1000}) 03:37:04 executing program 1: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/commit_pending_bools\x00', 0x1, 0x0) write$P9_RCREATE(r0, &(0x7f0000000040)={0x18, 0x73, 0x2, {{0x1, 0x2, 0x6}, 0x9}}, 0x18) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000080)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) [ 456.308427] binder_alloc: 18100: binder_alloc_buf failed to map page at 20001000 in userspace [ 456.334392] binder: 18100:18103 transaction failed 29201/-12, size 0-0 line 3136 [ 456.345478] binder_alloc: binder_alloc_mmap_handler: 18100 20001000-20004000 already mapped failed -16 03:37:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) ioctl$IOC_PR_REGISTER(r1, 0x401870c8, &(0x7f00000000c0)={0xffffffffffffffff, 0xff}) sendfile(r1, r0, &(0x7f0000000000), 0x9d6b) write(r1, &(0x7f0000000040)="a85883156f794c05e0b0", 0xa) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x84000, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) [ 456.364428] binder: 18104:18116 ioctl c0306201 20000440 returned -14 [ 456.375673] binder: 18104:18116 ioctl c0306201 20000440 returned -14 [ 456.428076] binder: BINDER_SET_CONTEXT_MGR already set [ 456.433585] binder_alloc: 18100: binder_alloc_buf, no vma [ 456.439706] binder: 18100:18103 ioctl 40046207 0 returned -16 03:37:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) eventfd(0x40) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) [ 456.452278] binder: 18121:18123 ioctl c0306201 20000440 returned -14 [ 456.456212] device lo entered promiscuous mode [ 456.458718] device lo entered promiscuous mode [ 456.458959] binder: 18121:18127 ioctl c0306201 20000440 returned -14 03:37:04 executing program 2: r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x400a00, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r0, 0x40046207, 0x0) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r2, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) dup2(r2, r0) sendfile(r2, r1, &(0x7f0000317000), 0x5) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) [ 456.466465] device lo left promiscuous mode [ 456.476989] binder: undelivered TRANSACTION_ERROR: 29201 [ 456.552400] binder: 18100:18114 transaction failed 29189/-3, size 0-0 line 3136 [ 456.561886] binder: 18130:18131 ioctl c0306201 20000440 returned -14 03:37:04 executing program 7: r0 = socket$l2tp(0x18, 0x1, 0x1) r1 = fcntl$dupfd(r0, 0xc8668d7be40d381, r0) write$FUSE_INIT(r1, &(0x7f0000000080)={0x50, 0x0, 0x6, {0x7, 0x1b, 0x8c, 0x0, 0x0, 0x6, 0x1, 0x5}}, 0x50) connect$l2tp(r0, &(0x7f0000000040)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x0, 0x0, 0x4, {0xa, 0x0, 0x0, @mcast2}}}, 0x32) getsockopt$packet_buf(r0, 0x111, 0x5, &(0x7f0000000140)=""/162, &(0x7f0000000000)=0xfffffffffffffca3) [ 456.567544] binder: 18130:18131 ioctl c0306201 20000440 returned -14 [ 456.611509] binder: undelivered TRANSACTION_ERROR: 29189 [ 456.627619] binder: 18135:18136 ioctl c0306201 20000440 returned -14 03:37:04 executing program 6: syz_mount_image$msdos(&(0x7f0000000180)='msdos\x00', &(0x7f0000000100)='./file0\x00', 0xe800, 0x1, &(0x7f00000001c0)=[{&(0x7f0000000140)="eb3c906d6b66732e66617400020401000200027400f8", 0x16}], 0x0, &(0x7f0000000080)=ANY=[]) r0 = open(&(0x7f0000021000)='./file0\x00', 0x0, 0x0) fchdir(r0) r1 = open(&(0x7f0000000280)='./bus\x00', 0x141042, 0x0) fcntl$setstatus(r1, 0x4, 0x6100) sendfile(r1, r1, &(0x7f00000000c0), 0x8080fffffffe) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) 03:37:04 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) socketpair$inet6_udplite(0xa, 0x2, 0x88, &(0x7f0000000040)={0xffffffffffffffff}) seccomp(0x0, 0x0, &(0x7f0000000280)={0x5, &(0x7f0000000240)=[{0x7fff, 0xed, 0x8000, 0xfffffffffffffffa}, {0x2, 0x0, 0x81, 0x6c}, {0x2, 0x8, 0x87, 0x6}, {0x101, 0x200, 0xdfa, 0x9}, {0x9, 0x8, 0xf3}]}) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000180)=0x10, 0x4) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) 03:37:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000140)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x1) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BLKTRACESTART(r1, 0x1274, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:37:04 executing program 7: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @remote}, 0xb3) sendto$inet(r0, &(0x7f0000000000), 0x0, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) fgetxattr(r0, &(0x7f0000000000)=@known='com.apple.system.Security\x00', &(0x7f0000000100)=""/105, 0x69) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f00000015c0)="766574683100000000ffffffffffef00", 0xb) sendto$inet(r0, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0), 0x6) [ 456.650565] binder: 18135:18139 ioctl c0306201 20000440 returned -14 03:37:04 executing program 6: mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x32, 0xffffffffffffffff, 0x0) r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_int(r0, 0x0, 0xcf, &(0x7f0000000000), 0x4) r1 = open(&(0x7f000000fffa)='./bus\x00', 0x141042, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0xa000)=nil, 0xa000, 0x0, 0x800011, r1, 0x0) mremap(&(0x7f000000a000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f0000005000/0x1000)=nil) mremap(&(0x7f0000005000/0x1000)=nil, 0x1000, 0x1000, 0x3, &(0x7f000000a000/0x1000)=nil) [ 456.731911] device lo left promiscuous mode [ 456.739470] binder: 18149:18152 ioctl c0306201 20000440 returned -14 [ 456.754306] device lo entered promiscuous mode [ 456.761841] device lo left promiscuous mode [ 456.792122] binder: 18149:18162 ioctl c0306201 20000440 returned -14 03:37:04 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB="2c726f6f746d6f64653d30303030303030303030303030303030303034303030302c757365725f69643da6deec129c20341637c300d363fcf9e36729439941388e884e510001000000000000f2df184a8092381d476fd79318377aa63a5f1600fa42592beca06f10198c00066f7a9e41ddf5ac7524912d4e4d9cbff016b40c365daa7e98c1f4b12482ffdc3fc5ec5e5fa6ef2d42957334a845a156eab7732f17923d1f5239d1f11127ab7c4ae8cef6329a05bcd13fc0441d57b7ce000000000000000000009bec73a0a1e617431ec8213602e115ae2c83fa08d0ce18e33191d9117f4de3571358ba482fe35d23ac7f704877d46ad67e772f42baf75faa06de4042cf3c90b5e8ef85127a9038e2ccf754fcac444eb1672cd8bbbb0216c54a00511e2e805084f92bf724fbc98e162a3115ecac8b17b22147c41be4fa3e76718b9c0229eb094506aee5c0034dfea2b5a7ee0d51e0fc54dbed95a813578e9bc4afaf8215dfc1c6928c0500000000000000101a7eccafc7ee498d52696b392e1202", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB="634a01a077992f470085153208c1cdb65c0a91bef74c33c01a56942e0f254a819309d30ac530aeceb903"]) read$FUSE(r1, &(0x7f00000030c0), 0x1000) ioctl$int_in(r1, 0x5421, &(0x7f0000000a00)=0x3) read$FUSE(r1, &(0x7f0000001000), 0x1000) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:37:04 executing program 1: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="025cc83d6d345f8f760070") capset(&(0x7f0000000080)={0x19980330}, &(0x7f00000000c0)) setgid(0x0) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040)='/dev/autofs\x00', 0x40000, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(r1, 0x40086200, &(0x7f0000000000)) 03:37:04 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) r1 = socket(0x10, 0x3, 0x9) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) keyctl$instantiate_iov(0x14, 0x0, &(0x7f00000002c0), 0x0, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000080)="2f65786500000000000409004bddd9de91be10eebf000ee9a90f798058439ed554fa07424adee901d2da75af1f02acc7edbcd7a071fb35331ce39c5a") sendfile(r1, r2, &(0x7f00000000c0), 0x80000002) ioctl(r0, 0x8912, &(0x7f0000000240)) unshare(0x20003fe) ioctl$sock_FIOGETOWN(r0, 0x8903, &(0x7f0000000280)=0x0) ioprio_get$pid(0x1, r3) socketpair(0x1f, 0x0, 0x4, &(0x7f0000000040)={0xffffffffffffffff}) ioctl$EVIOCSABS20(r4, 0x401845e0, &(0x7f0000000080)={0x3ff, 0x0, 0x0, 0x9, 0x9, 0x1}) prctl$setmm(0x23, 0x7, &(0x7f0000ffd000/0x2000)=nil) 03:37:04 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000200)={0x63, 0x0, &(0x7f00000001c0), 0xfffffffffffffee6, 0x0, &(0x7f00000000c0)="52e725be67e2f63fb66b13307d40d40700df9c5dd28a26fc31ad97c82387be3660032b3fef2eba69b337b44fedc1210c915bb1b0e2a21dfba25f0dfd68800d68c16b32204e5e52d2974d8cc486e231b1b768ad67021e665644dc20d32442fa2e0ca8ee975065e3854588ac7b229aad81eb0db4da1be6e0dddd433b02fa7f0000007580a4d53646bde7ae55e8368d27000000000000000000000000000000"}) [ 456.882043] device lo entered promiscuous mode [ 456.910232] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=258 sclass=netlink_audit_socket pig=18177 comm=syz-executor7 [ 456.915515] binder: 18171:18178 ioctl c0306201 20000200 returned -14 [ 456.923822] device lo left promiscuous mode [ 456.980559] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=10488 sclass=netlink_audit_socket pig=18177 comm=syz-executor7 [ 456.997661] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=1200 sclass=netlink_audit_socket pig=18177 comm=syz-executor7 [ 457.016484] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=0 sclass=netlink_audit_socket pig=18177 comm=syz-executor7 [ 457.031380] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=9348 sclass=netlink_audit_socket pig=18177 comm=syz-executor7 [ 457.044821] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=18630 sclass=netlink_audit_socket pig=18177 comm=syz-executor7 [ 457.057942] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=64137 sclass=netlink_audit_socket pig=18177 comm=syz-executor7 [ 457.071015] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=12712 sclass=netlink_audit_socket pig=18177 comm=syz-executor7 [ 457.085767] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=12544 sclass=netlink_audit_socket pig=18177 comm=syz-executor7 [ 457.099052] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=5 sclass=netlink_audit_socket pig=18177 comm=syz-executor7 [ 457.113155] device lo entered promiscuous mode [ 457.120972] device lo left promiscuous mode [ 457.468850] IPVS: Creating netns size=2536 id=112 [ 457.640248] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 457.653733] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 457.709586] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 457.722929] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 457.778160] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 457.791669] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 457.806258] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 457.821611] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 458.465615] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 458.500993] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 458.507238] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 458.513844] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:37:07 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:37:07 executing program 6: r0 = socket$inet(0x10, 0x200000003, 0x80) sendmsg(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="240000002d0007031dfffd946fa28300cee60a0009000000001d85680002000000000000", 0x24}], 0x1}, 0x0) 03:37:07 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x800, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000040)='./file0/file0\x00', 0x200001, 0x179) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000a496000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f000400000000000000000000"], 0x90) 03:37:07 executing program 1: r0 = perf_event_open(&(0x7f0000940000)={0x2, 0x70, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext={0xffff}, 0x39}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r1 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000240)='/dev/keychord\x00', 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000080)="42bb1efa6bd958285e84a9248de611c25ba3a5de6bf9a3af010511e6913998a5eddda333573748df35dd0a9817d0e0a7efea411c90060534e1932143ce1cc7af38fa614fa7e664c32be068d40489ca107b5f12d1d86ec94282b853f449ee57c36648db8f74c4a5b7a81dec7c32104d241bce95bbe0ae3c1ff9505235ba5509689787dba9a42a6729bcc2bc720891068f4ad1c7a1d6944c01383fef53f30ca22d4fdf7c8c2ebe", 0xa6, 0x800, 0x0, 0x0) getsockopt$IP_VS_SO_GET_SERVICE(r1, 0x0, 0x483, &(0x7f0000000140), &(0x7f00000001c0)=0x68) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x3, 0x80011, r0, 0x0) sigaltstack(&(0x7f0000000000/0x1000)=nil, &(0x7f0000000040)) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000000)) 03:37:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2c, 0x0, &(0x7f0000000080)=[@free_buffer={0x40086303, r2}, @acquire, @acquire={0x40046305, 0x3}, @clear_death={0x400c630f, 0x3, 0x1}], 0x0, 0x0, &(0x7f00000003c0)}) 03:37:07 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_mls(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/mls\x00', 0x0, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000240)={0xb, 'syz1\x00', 'syz1\x00', 'syz1\x00', 0x44, 0x100000001, 0x8, 0x9, 0x6, 0x1be2, "89a07c68770515474afca4a3df7d7a16b4a63bc97914debf2030dc93ed01d07e9a398fa14adb4a31098d007c2bc469b95009b31e0e2ecd9480de1d150442a2a08daecbd3"}, 0x15c) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) set_tid_address(&(0x7f0000000040)) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:37:07 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000200)=ANY=[@ANYBLOB="0000000000fa18dd78651c804199ce5829ce4f516980e6993c1e56daa093e1dde5dcb23e6b4326a570821160d52675f506725322d3a5df26"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:37:07 executing program 7: sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x40000000000009) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @dev, 0x4}, 0x1c) openat$rfkill(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/rfkill\x00', 0x8000, 0x0) syz_open_dev$mice(&(0x7f0000000280)='/dev/input/mice\x00', 0x0, 0x20200) openat$pfkey(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/self/net/pfkey\x00', 0x0, 0x0) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000300)='/dev/rfkill\x00', 0x10400, 0x0) r1 = memfd_create(&(0x7f0000000340)='$ppp1*@\x00', 0x3) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000380)='net/ip6_mr_cache\x00') ioctl$BLKPBSZGET(r2, 0x127b, &(0x7f0000000200)) setsockopt$inet6_mtu(r0, 0x29, 0x17, &(0x7f0000000180)=0x5, 0x4) sendmmsg(r0, &(0x7f00000002c0), 0x400000000000174, 0x0) r3 = gettid() sched_setscheduler(r3, 0x6, &(0x7f0000000140)=0x100000001) ioctl$sock_inet_SIOCGIFPFLAGS(r1, 0x8935, &(0x7f00000000c0)={'yam0\x00', 0x100000000}) 03:37:07 executing program 6: r0 = socket$inet6(0xa, 0x2, 0x0) ioctl(r0, 0x8912, &(0x7f00000000c0)="0a5cc80700315f85715070") r1 = socket$inet(0x2, 0x80003, 0x7) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000469ffc)=0x7fe, 0x4) sendto$inet(r1, &(0x7f0000edf000), 0x0, 0x0, &(0x7f0000000000), 0x10) recvmsg(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001440), 0x0, &(0x7f0000603000)=""/81, 0x51}, 0x0) r2 = memfd_create(&(0x7f0000000080)=':\x00', 0x1) ioctl$KDSETKEYCODE(r2, 0x4b4d, &(0x7f0000000100)={0xfffffffffffffa7d, 0x2}) [ 459.568395] device lo entered promiscuous mode 03:37:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x800) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000580)='/dev/ppp\x00', 0x10400, 0x0) timerfd_settime(r1, 0x1, &(0x7f00000005c0)={{0x0, 0x989680}, {0x0, 0x1c9c380}}, &(0x7f0000000600)) r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000400)={0xb0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="046304400300000011634840000000000000000001000000000000000000000001000000000000000000000018000000000000003800000000000000", @ANYPTR=&(0x7f0000000180)=ANY=[@ANYBLOB="a52a6480010c0000", @ANYRES32=r2, @ANYBLOB="000000000200000000000000"], @ANYPTR=&(0x7f00000001c0)=ANY=[@ANYBLOB="3800000000000000400000000000000020000000000000f02f00000000000000200000000000000038000000000000003800000000000000"], @ANYBLOB="00000080000000000d630000046304400100000011634840030000000000000000000000000000000000000010000000000000000000000068000000000000004800000000000000", @ANYPTR=&(0x7f0000000300)=ANY=[@ANYBLOB="852a747001000000", @ANYPTR=&(0x7f0000000200)=ANY=[@ANYBLOB='\x00'], @ANYBLOB="010000000000000000000000000000003c00000000000000856164660000000002000000533264c1c2bb5993000000002c0000000000000085616466000000000500000000000000040000ddffffff002200000000000000"], @ANYPTR=&(0x7f0000000380)=ANY=[@ANYBLOB="380000000000000038000000000000004800000000000000400000000000000038000000000000003800000000000000380000000000000078000000000000001800000000000000"], @ANYBLOB="06000000000000000d630000"], 0x1, 0x0, &(0x7f0000000240)='{'}) write(r2, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x4, 0x10, r2, 0x0) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) mq_timedsend(r2, &(0x7f0000000040)="12ca7ccde07756d8171013bdb9062d123de35d76d39d3c1676e5e4d38aaf209ac29eb41b422504e7e4aafceeb42926c1e4723d35943fcd6d5fddf057dbd743e446102db3ec798d88f4009b5581c9ff56402a5df0325b2a0d7815039646dfffa310756260bab5d46b6944cf05fbcb269a8dc4a2b5fca5ccfad0940e9405d920662c954742653cdf347c52c15a1ebfb11b1a68a6db2a3b8412e042bb5013bca3bf5386ba8fa37725208406e3bbe639ff", 0xaf, 0x7ff, &(0x7f0000000140)={r3, r4+30000000}) sendfile(r2, r2, &(0x7f0000317000)=0xfffffffffffffffe, 0xff8) write$FUSE_GETXATTR(r2, &(0x7f0000000540)={0x18, 0x0, 0x2, {0x4}}, 0x18) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) fchdir(r2) [ 459.597379] device lo left promiscuous mode [ 459.606222] binder: 18570:18575 ioctl c018620b 20000040 returned -14 [ 459.607005] binder: 18570:18575 ioctl c0306201 20000440 returned -14 [ 459.613978] binder: 18570:18575 ioctl c018620b 20000040 returned -14 03:37:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2c, 0x0, &(0x7f0000000080)=[@free_buffer={0x40086303, r2}, @acquire, @acquire={0x40046305, 0x3}, @clear_death={0x400c630f, 0x3, 0x1}], 0x0, 0x0, &(0x7f00000003c0)}) 03:37:07 executing program 7: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r0, &(0x7f0000deb000)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r0, &(0x7f0000000040), 0x0, 0x20000800, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) sched_setaffinity(0x0, 0x3cb, &(0x7f00000000c0)=0x9) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000100)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$VT_OPENQRY(r1, 0x5600, &(0x7f00000001c0)) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$SNDRV_TIMER_IOCTL_PARAMS(0xffffffffffffffff, 0x40505412, &(0x7f0000000480)) mmap(&(0x7f00001bf000/0x2000)=nil, 0x2000, 0x0, 0x4011, 0xffffffffffffffff, 0x0) creat(&(0x7f00000000c0)='./file0\x00', 0x0) getsockopt$ARPT_SO_GET_INFO(0xffffffffffffffff, 0x0, 0x60, &(0x7f00000002c0)={'filter\x00'}, &(0x7f0000000340)=0x44) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000140)="db04", 0x2) sendto$inet(r0, &(0x7f0000000000), 0xfffffffffffffe4e, 0xc0, &(0x7f00000000c0), 0x6) sendmsg$IPVS_CMD_GET_CONFIG(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000040), 0xc, &(0x7f0000000140)={&(0x7f00000000c0)={0x1c, 0x0, 0x304, 0x70bd2c, 0x0, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}]}, 0x1c}}, 0x0) 03:37:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)=0x0) fcntl$lock(r0, 0x6, &(0x7f0000000080)={0x1, 0x4, 0x5, 0x9, r2}) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) [ 459.616162] binder: 18570:18588 ioctl c0306201 20000440 returned -14 03:37:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) getsockopt$inet6_buf(r1, 0x29, 0x14, &(0x7f0000000040)=""/23, &(0x7f0000000080)=0x17) [ 459.737695] binder: 18598:18602 ioctl c018620b 20000040 returned -14 [ 459.740909] binder: 18605:18607 ioctl c0306201 20000440 returned -14 [ 459.754588] binder: 18605:18607 ioctl c0306201 20000440 returned -14 03:37:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2c, 0x0, &(0x7f0000000080)=[@free_buffer={0x40086303, r2}, @acquire, @acquire={0x40046305, 0x3}, @clear_death={0x400c630f, 0x3, 0x1}], 0x0, 0x0, &(0x7f00000003c0)}) [ 459.789526] binder: 18598:18602 ioctl c0306201 20000440 returned -14 03:37:07 executing program 2: r0 = syz_open_dev$mice(&(0x7f0000000040)='/dev/input/mice\x00', 0x0, 0x200000) ioctl$RTC_ALM_READ(r0, 0x80247008, &(0x7f0000000080)) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r2, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) sendfile(r2, r2, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) [ 459.831946] binder: 18611:18613 ioctl c0306201 20000440 returned -14 [ 459.842013] binder: 18611:18613 ioctl c0306201 20000440 returned -14 [ 459.891781] binder: 18619:18620 ioctl c0306201 20000440 returned -14 [ 459.906718] binder: 18615:18616 ioctl c018620b 20000040 returned -14 [ 459.918917] binder: 18615:18616 ioctl c0306201 20000440 returned -14 [ 459.943021] device lo entered promiscuous mode [ 459.954214] device lo left promiscuous mode 03:37:07 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:37:07 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) [ 460.070224] binder: 18627:18628 ioctl c0306201 20000440 returned -14 [ 460.078517] binder: 18627:18628 ioctl c0306201 20000440 returned -14 03:37:08 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000140)='/dev/loop#\x00', 0xfffffffffffffffd, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x3, 0x4) r1 = socket$inet_tcp(0x2, 0x1, 0x0) connect(r1, &(0x7f0000000040)=@ax25={0x3, {"c677c822420674"}, 0x200}, 0x80) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:37:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)={0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x2c, 0x0, &(0x7f0000000080)=[@free_buffer={0x40086303, r2}, @acquire, @acquire={0x40046305, 0x3}, @clear_death={0x400c630f, 0x3, 0x1}], 0x0, 0x0, &(0x7f00000003c0)}) 03:37:08 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={'\x00', 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0900000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) fcntl$F_GET_RW_HINT(r3, 0x40b, &(0x7f0000000200)) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:37:08 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) r1 = open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) getsockopt$inet6_mtu(r1, 0x29, 0x17, &(0x7f0000000040), &(0x7f0000000240)=0x1) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) r2 = gettid() r3 = getpgrp(0xffffffffffffffff) rt_tgsigqueueinfo(r2, r3, 0xc, &(0x7f0000000180)={0x26, 0x1, 0x7, 0x45}) 03:37:08 executing program 2: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200)='/dev/sequencer2\x00', 0x1, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8924, &(0x7f0000000240)={'tunl0\x00', @dev={[], 0x15}}) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r2, &(0x7f0000000000)="a8588315000267fce0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r2, 0x0, 0x48f, &(0x7f00000001c0)={0x4, @broadcast, 0x4e23, 0x0, 'fo\x00', 0x3d, 0x9}, 0x2c) ioctl$SG_GET_REQUEST_TABLE(r2, 0x2286, &(0x7f0000000040)) r3 = openat$cgroup_ro(r0, &(0x7f0000000300)='memory.events\x00', 0x0, 0x0) sendfile(r2, r2, &(0x7f0000317000), 0xff8) read(r3, &(0x7f0000000340)=""/242, 0xf2) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:37:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) [ 460.378166] device lo entered promiscuous mode [ 460.396710] device lo left promiscuous mode [ 460.409388] binder: 18635:18637 ioctl c0306201 20000440 returned -14 [ 460.416654] binder: 18636:18640 ioctl c018620b 20000040 returned -14 [ 460.417186] binder: 18636:18640 ioctl c0306201 20000440 returned -14 [ 460.466545] binder: 18646:18649 ioctl c018620b 20000040 returned -14 03:37:08 executing program 6: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x80000001}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f0000000340)) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$TIOCNOTTY(r0, 0x5422) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) write(r0, &(0x7f0000000400)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) sendfile(r0, r1, 0x0, 0x10000) ioctl$TCSETAW(r2, 0x5407, &(0x7f0000000040)={0x2, 0x40, 0x6, 0x2, 0x2, 0x0, 0x5, 0x1, 0x3ff, 0x1}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0}, &(0x7f0000000140)=0xc) ioctl$SCSI_IOCTL_GET_PCI(r2, 0x5387, &(0x7f0000000200)) ioctl$RTC_EPOCH_SET(r0, 0x4008700e, 0xf96) write$cgroup_pid(r0, &(0x7f0000000180)=r3, 0x12) ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f00000001c0)={0x3, 0x38, 0x17, 0x1a, 0x8, 0x9, 0x3, 0x2, 0xffffffffffffffff}) 03:37:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r0, r1, &(0x7f0000000200)=0x100000000005e, 0x9) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000300), 0x78, 0x0, &(0x7f0000000180)="1179a19f4a5b408145bebd2b012145e301008211ba482300d67a04a7e176c4806f49804a1f3d7ef74da2cfb91b7a7e7ed05b48195282b51c762693300fe7f131273053e5b7f506003a13f00100000000000000747704d8e4cc7da4f0f6bcec6b0358c756f440a6b7f7b4b3657a4475d3ebc5bb7406000000"}) 03:37:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:08 executing program 7: r0 = socket$inet6(0xa, 0x0, 0x0) r1 = dup(r0) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000200)=0x5) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = fcntl$getown(r1, 0x9) ioctl$BLKIOMIN(r1, 0x1278, &(0x7f0000000340)) r3 = syz_open_procfs(r2, &(0x7f00000001c0)='net/netlink\x00') ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000540)={[], 0x8, 0x6, 0x4, 0x1ff, 0x3, r2}) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e20}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f00000007c0), 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r4 = open(&(0x7f00000008c0)='./file0\x00', 0x20141042, 0x0) ftruncate(r4, 0x80080) sendto$inet(r4, &(0x7f0000000240)="2590e75c412f44bec81babcbe5d57f41388c", 0x12, 0x4004040, 0x0, 0x0) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) r6 = getuid() syz_mount_image$msdos(&(0x7f0000000600)='msdos\x00', &(0x7f0000000640)='./file1/file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000bc0)="1ffa15507d6c755fe9a30f1fd8090d774dcf4ba055dc01d3f11fcd21635c8abb81b9170d803b78129cf7148b9daa569101da6823e1bf4f078168fb62b4af98748e82ba11963fc4b8ebc98c32a3006324b82548f2b71f75c6f85b004c9f458c50586c950f9f32f08427b1bb64436692e1a90adb123e34dca2282368c4e5aa5c89d209b1cc8874a80aede2263ffd1d01765ebf082fb0c788a6bf25cf0d7a915d60d6c9f3f7f2ef8ecebd715fc2e0c2c376eb1b88bf1d2f7480745bc3a5605ce7d5831ca54efa182593b943", 0xca, 0x5}], 0x1000, &(0x7f0000001240)=ANY=[@ANYBLOB="666c7573682c747a3d5554432c6e6f646f74732c74696d655f6f66667365743d3078666666666666666666666666666231362c646f74732c666d61736b3d30302830303030303030303030303030303030303030352c6e6f646f74732c7569643d7eeeb5500b076d9a74f1fd2bc090d200a2a63545b0be006e1a3bfe8c1d465cf4b38508b0f720425b3870adafa3197288b1944f3406b3670f86699f75c90d936b47e6868495fa09a5f03222bac77f252c51b555c87990bd4f51f14f5b80cfd4ca5f9c6e73862c50fd6fa052e44d2b8cb8a429da44a81ea087d9606c85f7774965c78d2954bfc7292528792d7ecf9c08903d37d94ce3535daf11629a6285ab9afa323629d92b056db9e4c4083555d03b8c685a0669563cc1ff85f10c58b66ef002268ba9862e7a345dc10943ae070dbeb6de43356b5b6702c41b319d23fab2bef6e26f779c7c39a7e282f2c747c4ec3a310c699bae13e0db11e8d8e2693300e65a16ef500dc13cf9b0bae403689b358eaf2601d97ab8625bd8dac6d8371c00fafcd5a0d6866239d51453526c6968d0f5e630b29aaeec6ee5c948eeec81f4b24d363103eb7a195ab694073f6ff7f5824aace0daa7328ec3ba2b3fb57f00981745635383bcd8f83f000000c9e09a705e4fec3b4b2f4ed66b256ac5e04141cb1d90b5e3887500ab6013c4f7b0adf1eae7f9a21fca98358dfd3fe24781b237e54e4252c3df8e90c7de856ef812865a54092bf0d2f20ad74f4f92060000003039e31bb1e754ae5e868e53edfe76a08f957b519717e86d0db6f7ac2948373a18fc0c660ed2e41242c92a8670f6a8b517e26a4056c9ce2c62898cd57b9f0edb7db37866ed5d98d400000000000000", @ANYRESHEX=r6]) getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000002c0), &(0x7f0000000300)=0x4) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r5, &(0x7f0000000000), 0xa4, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) ioctl$ASHMEM_GET_SIZE(r4, 0x7704, 0x0) getsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f0000000e40), &(0x7f0000000e80)=0x4) ioctl$TUNGETFEATURES(r1, 0x800454cf, &(0x7f00000005c0)) setsockopt$inet_opts(r5, 0x0, 0x0, &(0x7f0000000480)="61f107fc86df2d0a88b16226936dffc673aa008e7697432e419f11bf4abe5a3fb786f2a24d832deabb626a596e812647cdc4d319e476faeb311486c4d87036c75a16de243400af929c9981bdf78eafe27e64b3685e3229", 0x57) pivot_root(&(0x7f0000000840)='./file2\x00', &(0x7f0000000880)='./file0\x00') setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f00000015c0)="766574683100000000ffffffffffef00", 0xb) sendmsg(r5, &(0x7f0000000700)={&(0x7f0000000100)=@vsock={0x28, 0x0, 0x0, @reserved}, 0x80, &(0x7f0000000640), 0x0, &(0x7f0000002600)}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r7, &(0x7f0000000180)={&(0x7f00000000c0), 0xc, &(0x7f0000000140)={&(0x7f0000000d00)={0x14, 0x3, 0x2, 0x3}, 0x14}}, 0x0) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000040)='tunl0\x00', 0x10) syz_mount_image$btrfs(&(0x7f0000000280)='btrfs\x00', &(0x7f0000000380)='./file1\x00', 0x10001, 0x1, &(0x7f0000000500)=[{&(0x7f0000000400)="c6b087821bfb34ea22ebf674b903f3d4d9ccd63a609c3ac2bec63ca10a4e246a05c206e7ada6dd", 0x27, 0x9}], 0x0, &(0x7f0000000740)=ANY=[]) 03:37:08 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) rmdir(&(0x7f0000000040)='./file0\x00') read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) 03:37:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$EVIOCGPHYS(r1, 0x80404507, &(0x7f00000001c0)=""/97) sendfile(r1, r0, &(0x7f0000317000)=0x20000000000, 0x7) mount$9p_unix(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='9p\x00', 0x8, &(0x7f0000000100)={'trans=unix,', {[{@access_any='access=any'}, {@debug={'debug', 0x3d, 0x100000000}}, {@uname={'uname', 0x3d, "2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828"}}]}}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:37:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) [ 460.593498] device lo entered promiscuous mode [ 460.605451] device lo left promiscuous mode [ 460.632517] binder: 18661:18663 ioctl c018620b 20000040 returned -14 03:37:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:08 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) ppoll(&(0x7f0000000040)=[{r0, 0x4000}, {r0, 0x40}, {r1, 0x20}], 0x3, &(0x7f00000000c0)={0x77359400}, &(0x7f0000000100)={0x3ff}, 0x8) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) [ 460.710821] binder: 18676:18680 ioctl c0306201 20000440 returned -14 [ 460.870592] binder: 18690:18697 ioctl c0306201 20000440 returned -14 [ 461.579001] binder: 18690:18697 ioctl c0306201 20000440 returned -14 [ 463.028393] IPVS: Creating netns size=2536 id=113 [ 463.204513] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 463.218677] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 463.273359] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 463.288044] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 463.343564] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 463.357515] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 463.372291] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 463.387551] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 464.034137] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 464.070198] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 464.076579] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 464.083208] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:37:12 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:37:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:12 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) epoll_create(0x9) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:37:12 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c60726f75705f69643deef93c06b659b82787edbf46aaef4fe73d783e774f9a634a908af630ad", @ANYRESDEC=0x0, @ANYBLOB=',\x00']) r1 = open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) r2 = getuid() getresgid(&(0x7f0000000280), &(0x7f0000000300)=0x0, &(0x7f0000000340)) mount$fuse(0x0, &(0x7f0000000180)='./file0/file0\x00', &(0x7f0000000240)='fuse\x00', 0x992080, &(0x7f00000005c0)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x8000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@allow_other='allow_other'}, {@blksize={'blksize', 0x3d, 0x1000}}, {@default_permissions='default_permissions'}, {@max_read={'max_read', 0x3d, 0x4}}, {@max_read={'max_read', 0x3d, 0x3}}, {@max_read={'max_read', 0x3d, 0x7}}]}}) read$FUSE(r0, &(0x7f00000030c0), 0x1000) ioctl$RTC_PIE_OFF(r1, 0x7006) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) accept4$unix(r1, 0x0, &(0x7f0000000040), 0x800) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) 03:37:12 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB="030000000000000008001b00000000003625e4be1c361fb6cc562c656dce30df5ee1c81d5d3dc5c206c8053129d88624e817ab9193c91518bd3f39bcc4277e1e1e4b181e597b81fd5b9055c3faa55d89b05897d1e3c9b30fab78e7cb44de887f996d0c3dfc8d7a2ac79df6772d0ced6b0f292e41d39264632eb1b8f7fc1881561e620db5c88fd7a452760943066fffed7dce9c6caf039a626bee1ed400c49f8670f237740565f226d21ef477bbadc51086bd08b91a371f2f0910c383090e2744c0b098883bd65cd58e7e491f7d93d8942ddd3db4e4da65e407da1da7a368e2f348092fd5f727ec5f2daaf003a1e8be10d4395642e42bcdf9e1a2fa610d8b0dfa2fd0d2c3b0d71e19c1231531df61b8758df0e0e9583b9cc689a258db3aa8c11e8588e645124ca3dd17db63daa872e82b2646bc0361003a9aebd6ffcb075982d5ab4abba23750da725972304a3dadd6472e511d02ba15230342ab6ca19acf49e50636d61ec5c72f5b4f01013cba36ef786fed56688b427a14235dbc81c7ad7bebf5de23c9504aabfa14f1b0dea5aa30cff9dbee4ea89033e26229d86beb83c0b11a5244eb127fa40e3af35395ae9231571e32a5f1dacd61eb105b13"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:37:12 executing program 6: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}, 0x0, 0x80000001}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = open(&(0x7f00000000c0)='./file0\x00', 0x40c2, 0x0) ioctl$SCSI_IOCTL_GET_IDLUN(r0, 0x5382, &(0x7f0000000340)) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) ioctl$TIOCNOTTY(r0, 0x5422) r2 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) write(r0, &(0x7f0000000400)="34fd98aa1d0e7adec937a5f331a75f487934f50242a0751944936972896c29a5068c8ecba1aa0a4e2a631b5180e1fbde79f4502dc4c4a1fba9dcd9ed83e639aefa1b87631c33d1a82cb0c0035676ddfeb0fe7984d7519b0f839d497fc9d64ef14d1de22220ff2623df4950134b9fb734a52adad95f131cce3672a9d7d7b400d2c62810b5f20351639330948107bf8d4534a03ac389455c54d8eb4d609b3e858b7213b38eb01f0eeaba3739ae927916e28da6a79a3fd5e32d30ab30bf959d4596e5ffbff6789a650b9e7d248d1ba849012336a4f3ef8fab07a8f5b81bb0bc45b2174538315ca12b7c723b2157562564a8a1f19d28179f8c565448e0e921b8c3e6fc4adaafa8b929ad077f633325b6a6f71a586cabc4883e03e19315f946b277858593a7367e232202fe9ad656c6768a1517da7f0498b48cb078e929fb11db0cc551f754bffc4859dd89a396915cc809b07d448573098409ea21371056f67ef4114ec10547f498d24513fe594308bf022868ad21e85bba811942fdc45161a1a8a7fe00d5c6b05ed7954f631bbd12a5c9a5cfa5965e0595de608b04ebe02b3fcbf3b9f57807a1a7ad8528992e2ec65949da2f4a0478dfd3ae52639c15d8aeaa351da6d393b58c772168fae604d097fef4d6b9360eb169a0b0ee70cdc22435a003e68698f61b3b63b1f51011bc8f4ef944c1de821785f670124a1c6ed18335d63412", 0x200) sendfile(r0, r1, 0x0, 0x10000) ioctl$TCSETAW(r2, 0x5407, &(0x7f0000000040)={0x2, 0x40, 0x6, 0x2, 0x2, 0x0, 0x5, 0x1, 0x3ff, 0x1}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000100)={0x0}, &(0x7f0000000140)=0xc) ioctl$SCSI_IOCTL_GET_PCI(r2, 0x5387, &(0x7f0000000200)) ioctl$RTC_EPOCH_SET(r0, 0x4008700e, 0xf96) write$cgroup_pid(r0, &(0x7f0000000180)=r3, 0x12) ioctl$RTC_SET_TIME(r0, 0x4024700a, &(0x7f00000001c0)={0x3, 0x38, 0x17, 0x1a, 0x8, 0x9, 0x3, 0x2, 0xffffffffffffffff}) 03:37:12 executing program 7: r0 = socket$inet6(0xa, 0x0, 0x0) r1 = dup(r0) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000200)=0x5) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = fcntl$getown(r1, 0x9) ioctl$BLKIOMIN(r1, 0x1278, &(0x7f0000000340)) r3 = syz_open_procfs(r2, &(0x7f00000001c0)='net/netlink\x00') ioctl$BLKTRACESETUP(r1, 0xc0481273, &(0x7f0000000540)={[], 0x8, 0x6, 0x4, 0x1ff, 0x3, r2}) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e20}, 0x1c) sendto$inet6(0xffffffffffffffff, &(0x7f00000007c0), 0x0, 0x0, &(0x7f00008d4fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) r4 = open(&(0x7f00000008c0)='./file0\x00', 0x20141042, 0x0) ftruncate(r4, 0x80080) sendto$inet(r4, &(0x7f0000000240)="2590e75c412f44bec81babcbe5d57f41388c", 0x12, 0x4004040, 0x0, 0x0) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) r6 = getuid() syz_mount_image$msdos(&(0x7f0000000600)='msdos\x00', &(0x7f0000000640)='./file1/file0\x00', 0x0, 0x1, &(0x7f0000000d80)=[{&(0x7f0000000bc0)="1ffa15507d6c755fe9a30f1fd8090d774dcf4ba055dc01d3f11fcd21635c8abb81b9170d803b78129cf7148b9daa569101da6823e1bf4f078168fb62b4af98748e82ba11963fc4b8ebc98c32a3006324b82548f2b71f75c6f85b004c9f458c50586c950f9f32f08427b1bb64436692e1a90adb123e34dca2282368c4e5aa5c89d209b1cc8874a80aede2263ffd1d01765ebf082fb0c788a6bf25cf0d7a915d60d6c9f3f7f2ef8ecebd715fc2e0c2c376eb1b88bf1d2f7480745bc3a5605ce7d5831ca54efa182593b943", 0xca, 0x5}], 0x1000, &(0x7f0000001240)=ANY=[@ANYBLOB="666c7573682c747a3d5554432c6e6f646f74732c74696d655f6f66667365743d3078666666666666666666666666666231362c646f74732c666d61736b3d30302830303030303030303030303030303030303030352c6e6f646f74732c7569643d7eeeb5500b076d9a74f1fd2bc090d200a2a63545b0be006e1a3bfe8c1d465cf4b38508b0f720425b3870adafa3197288b1944f3406b3670f86699f75c90d936b47e6868495fa09a5f03222bac77f252c51b555c87990bd4f51f14f5b80cfd4ca5f9c6e73862c50fd6fa052e44d2b8cb8a429da44a81ea087d9606c85f7774965c78d2954bfc7292528792d7ecf9c08903d37d94ce3535daf11629a6285ab9afa323629d92b056db9e4c4083555d03b8c685a0669563cc1ff85f10c58b66ef002268ba9862e7a345dc10943ae070dbeb6de43356b5b6702c41b319d23fab2bef6e26f779c7c39a7e282f2c747c4ec3a310c699bae13e0db11e8d8e2693300e65a16ef500dc13cf9b0bae403689b358eaf2601d97ab8625bd8dac6d8371c00fafcd5a0d6866239d51453526c6968d0f5e630b29aaeec6ee5c948eeec81f4b24d363103eb7a195ab694073f6ff7f5824aace0daa7328ec3ba2b3fb57f00981745635383bcd8f83f000000c9e09a705e4fec3b4b2f4ed66b256ac5e04141cb1d90b5e3887500ab6013c4f7b0adf1eae7f9a21fca98358dfd3fe24781b237e54e4252c3df8e90c7de856ef812865a54092bf0d2f20ad74f4f92060000003039e31bb1e754ae5e868e53edfe76a08f957b519717e86d0db6f7ac2948373a18fc0c660ed2e41242c92a8670f6a8b517e26a4056c9ce2c62898cd57b9f0edb7db37866ed5d98d400000000000000", @ANYRESHEX=r6]) getsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f00000002c0), &(0x7f0000000300)=0x4) bind$inet(r5, &(0x7f0000000080)={0x2, 0x4e23, @dev}, 0x10) sendto$inet(r5, &(0x7f0000000000), 0xa4, 0x200007fe, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x1e}}, 0x10) ioctl$ASHMEM_GET_SIZE(r4, 0x7704, 0x0) getsockopt$inet_mtu(r3, 0x0, 0xa, &(0x7f0000000e40), &(0x7f0000000e80)=0x4) ioctl$TUNGETFEATURES(r1, 0x800454cf, &(0x7f00000005c0)) setsockopt$inet_opts(r5, 0x0, 0x0, &(0x7f0000000480)="61f107fc86df2d0a88b16226936dffc673aa008e7697432e419f11bf4abe5a3fb786f2a24d832deabb626a596e812647cdc4d319e476faeb311486c4d87036c75a16de243400af929c9981bdf78eafe27e64b3685e3229", 0x57) pivot_root(&(0x7f0000000840)='./file2\x00', &(0x7f0000000880)='./file0\x00') setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f00000015c0)="766574683100000000ffffffffffef00", 0xb) sendmsg(r5, &(0x7f0000000700)={&(0x7f0000000100)=@vsock={0x28, 0x0, 0x0, @reserved}, 0x80, &(0x7f0000000640), 0x0, &(0x7f0000002600)}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_netfilter(r7, &(0x7f0000000180)={&(0x7f00000000c0), 0xc, &(0x7f0000000140)={&(0x7f0000000d00)={0x14, 0x3, 0x2, 0x3}, 0x14}}, 0x0) setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000040)='tunl0\x00', 0x10) syz_mount_image$btrfs(&(0x7f0000000280)='btrfs\x00', &(0x7f0000000380)='./file1\x00', 0x10001, 0x1, &(0x7f0000000500)=[{&(0x7f0000000400)="c6b087821bfb34ea22ebf674b903f3d4d9ccd63a609c3ac2bec63ca10a4e246a05c206e7ada6dd", 0x27, 0x9}], 0x0, &(0x7f0000000740)=ANY=[]) 03:37:12 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x800) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) ioctl$FIBMAP(r1, 0x1, &(0x7f0000000040)=0x10000) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:37:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:13 executing program 4: r0 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000240)='/selinux/enforce\x00', 0x101000, 0x0) openat$cgroup_subtree(r0, &(0x7f0000000280)='cgroup.subtree_control\x00', 0x2, 0x0) mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB="2c726f6f746d6f64653df80c3030303030303030303030303030303034303030302c757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) ioctl$TIOCGSID(0xffffffffffffff9c, 0x5429, &(0x7f0000000040)=0x0) write$P9_RGETLOCK(r1, &(0x7f0000000180)={0x1e, 0x37, 0x2, {0x1, 0x8, 0x2, r2}}, 0x1e) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r1, &(0x7f00000030c0), 0x1000) read$FUSE(r1, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) 03:37:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) fcntl$F_SET_RW_HINT(r0, 0x40c, &(0x7f0000000040)=0x4) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) sendfile(r1, r1, &(0x7f0000317000), 0xff8) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f00000000c0)={{{@in=@rand_addr, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6}}, &(0x7f00000001c0)=0xe8) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000200)={@mcast2, @mcast2, @remote, 0x8, 0x93, 0x5d28, 0x400, 0x0, 0x4440004, r2}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) [ 465.142147] device lo entered promiscuous mode [ 465.157434] binder: 19090:19092 ioctl c0306201 20000440 returned -14 [ 465.169373] binder: 19090:19108 ioctl c0306201 20000440 returned -14 03:37:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) [ 465.187668] binder: 19107:19109 ioctl c018620b 20000040 returned -14 03:37:13 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) sync() r1 = open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) r2 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r2, 0x8912, &(0x7f0000000280)="025cc80700145f8f764070") r3 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x13, &(0x7f0000001ffc)=0x1, 0x4) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x3, 0x31, 0xffffffffffffffff, 0x0) getsockopt$inet_tcp_int(r3, 0x6, 0x14, &(0x7f000000bffc), &(0x7f0000000040)=0x4) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) ioctl$ASHMEM_GET_PIN_STATUS(r1, 0x7709, 0x0) write$FUSE_DIRENT(r0, &(0x7f0000000040)=ANY=[@ANYRES32], 0xfffffffffffffdc1) 03:37:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) [ 465.260073] binder: 19119:19126 ioctl c018620b 20000040 returned -14 [ 465.266690] device lo left promiscuous mode 03:37:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) unlink(&(0x7f00000001c0)='./file0\x00') sendfile(r1, r1, &(0x7f0000317000), 0xff8) signalfd4(r1, &(0x7f0000000240)={0x2f}, 0x8, 0x80800) ioctl$PIO_UNIMAP(r1, 0x4b67, &(0x7f0000000080)={0xa, &(0x7f0000000040)=[{}, {0xc1f, 0xfffffffffffffffe}, {0x0, 0xbdf7}, {0x7, 0x2}, {0x8, 0x8}, {0x3, 0x10000000000}, {0x5, 0x6}, {0xc, 0x8000}, {0x1000, 0x101}, {0xfffffffffffffe01, 0x4}]}) ioctl$FS_IOC_GETFSLABEL(r0, 0x81009431, &(0x7f00000000c0)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:37:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) [ 465.356306] binder: 19138:19143 ioctl c018620b 20000040 returned -14 [ 465.376075] binder: 19140:19144 ioctl 81009431 200000c0 returned -22 [ 465.384566] binder: 19140:19144 ioctl c0306201 20000440 returned -14 [ 465.412918] binder: 19140:19149 ioctl 81009431 200000c0 returned -22 [ 465.489583] device lo entered promiscuous mode [ 465.496475] device lo left promiscuous mode 03:37:13 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(0xffffffffffffffff) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:37:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$SNDRV_TIMER_IOCTL_STATUS(r1, 0x80605414, &(0x7f0000000040)=""/42) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:37:13 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$int_in(0xffffffffffffffff, 0x0, &(0x7f0000000000)=0x1) socketpair(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x8946, &(0x7f0000000100)="6c6f00966fd651b159a9c84a2c60d29800000020") ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) setsockopt$inet_buf(r1, 0x0, 0x2b, &(0x7f0000000240)="bc9d30f2af6722b22d71ffe6e5c62903a57ce9ff0055df10b166b584bf894e9787c2f1fd681d6762c4b1ae634d83b087ed59d3fed6a3d3537a65a34c8db344620c5e4fb50b9c2dede719c59a914d7a6ddd278a3ba76e371c717403d59967491d9aca0f15966cb3910234ea0a37e8520f2c53729981791694d9726dd7ddbb6c6d11da78a7ac31f2b66819fa1ce361a40eafe4ae05908f102583382fb141b650c7877b7074d3613b7a226c74398d53f3979872f8d97984b46beea88b2e21f13630fab0515bb11a8687578ccf6aba3cbe7d5e06c121d22945eff864fdfe", 0xdc) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) [ 465.609709] device lo entered promiscuous mode 03:37:13 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) [ 465.632152] device lo left promiscuous mode [ 465.656926] binder: 19157:19161 ioctl c0306201 20000440 returned -14 [ 465.675817] binder: 19157:19169 ioctl c0306201 20000440 returned -14 [ 465.807001] device lo entered promiscuous mode [ 465.813750] device lo left promiscuous mode 03:37:13 executing program 6: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000000)="0a5cc80700315f85715070") r1 = syz_open_dev$sndtimer(&(0x7f0000f85ff1)='/dev/snd/timer\x00', 0x0, 0x0) ppoll(&(0x7f0000000540)=[{r1}], 0x1, &(0x7f0000000580)={0x0, 0x989680}, &(0x7f00000005c0), 0x8) 03:37:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:13 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x1) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0xae2e, 0xb9eb, 0x8001, 0x3}]}, 0x10) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) fadvise64(r0, 0x39, 0x6, 0x1) lseek(r1, 0x0, 0x7) ioctl$KDSKBSENT(r1, 0x4b49, &(0x7f00000000c0)="43e1632b714ace042e46021291d5739e4854a2bc58d1718dd17da7055a328bfead2fd5a992e87eafe8b417128320699a887830c16e4c23f04adeec7df25b8ba6918dcaa76ad323078d34eee29c675193d146d89b895e4178d46a6acaf04611417f3face3ed480c0476132839f7695837764657ea83b112aeb3131b6b8338adf8d6de4de33de3de3a501e94a8c5f522a190551e9bb6910f") 03:37:13 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) socketpair$inet6_udp(0xa, 0x2, 0x0, &(0x7f0000000000)) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:37:13 executing program 7: r0 = socket(0x10, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setsockopt$IP_VS_SO_SET_STOPDAEMON(r0, 0x0, 0x48c, &(0x7f0000000000)={0x0, 'ip6_vti0\x00', 0x2}, 0x18) setsockopt$l2tp_PPPOL2TP_SO_DEBUG(r0, 0x111, 0x1, 0x9, 0x4) setresuid(r1, r1, r1) setfsuid(0x0) 03:37:13 executing program 1: r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r0, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040)) 03:37:13 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) r5 = gettid() get_robust_list(r5, &(0x7f0000000380)=&(0x7f0000000340)={&(0x7f0000000280)={&(0x7f0000000200)}, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)}}, &(0x7f0000000400)=0x18) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) [ 465.987702] device lo entered promiscuous mode [ 466.024601] binder: 19184:19187 ioctl c0306201 20000440 returned -14 [ 466.031193] device lo left promiscuous mode [ 466.052935] binder: 19184:19201 ioctl c0306201 20000440 returned -14 [ 466.157233] device lo entered promiscuous mode [ 466.166877] device lo left promiscuous mode 03:37:14 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0xff2a, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}}, 0x11) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000680)=ANY=[@ANYBLOB="90000000f56c6dd05a6800000000000002000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b81de1eb9cc6370757365746367000000000000000000000000000000000000000000000037e6263003b21aea927bfc2ae3bbb2c7348129bddd6358b4d37820a154bf341178d44684352786cd8fe3b0fa50b23c5c037af78dffdcf958182077a652db016d0aef01f1241283ccaf988ba1bee91d923681864c5f16c505eaaa346b2345f9970d2695ff6fabdcf42b036a9f9964f852fd864993e75c7564b3d71e95ec3a51d8e2029aa15fca53b682b958132f8fcf7c44359ac526296c51e7e14b651f3145de37ae4ebb0e27f2a2912b574d10a991c7098d3aa037bd2e711c8ac4cba3ab20facac68f43fc2ae3e16a000000000000000000"], 0x90) 03:37:14 executing program 7: mkdir(&(0x7f0000000500)='./file0\x00', 0x0) mount(&(0x7f0000000480)='./file0\x00', &(0x7f0000026ff8)='./file0\x00', &(0x7f0000000300)='ramfs\x00', 0x0, &(0x7f00000002c0)) mount(&(0x7f0000d04000)='./file0\x00', &(0x7f0000903000)='./file0\x00', &(0x7f0000000340)='bdev\x00', 0x100000, &(0x7f00000002c0)) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000005c0)={'team0\x00'}) mount(&(0x7f0000000440)='./file0\x00', &(0x7f0000000280)='./file0\x00', &(0x7f0000000540)="a30d942aece9ce77f260c3796cef37c5836c6bd18ada870b1abd4ce3275a608efdea5dab7d559728d12ca10793ce04af832ff86f7468eb0463d595aa3bf790e787a81e9cb03e12cc2dec", 0x9004, 0x0) r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000001c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) mknodat(r0, &(0x7f0000000200)='./file0\x00', 0xc020, 0x1) mount(&(0x7f0000000000)='./file0\x00', &(0x7f00000000c0)='.', &(0x7f0000000140)='vxfs\x00', 0x3080, &(0x7f0000000200)) mount(&(0x7f00000008c0)='.', &(0x7f0000000080)='.', &(0x7f0000753000)='mslos\x00', 0x5010, &(0x7f0000000ac0)) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000040)='/dev/full\x00', 0x10402, 0x0) r2 = dup(0xffffffffffffff9c) renameat2(r1, &(0x7f0000000100)='./file0\x00', r2, &(0x7f0000000180)='./file0\x00', 0x0) mount(&(0x7f0000377ff8)='.', &(0x7f0000002e80)='./file0\x00', &(0x7f0000753000)='msdos\x00', 0x5010, &(0x7f0000000380)) 03:37:14 executing program 6: sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) r0 = socket(0x10, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x2, 0x70, 0x71}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sendto(r0, &(0x7f0000000000), 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f00001bf000/0x1000)=nil, 0x1000, 0x0, 0x10, 0xffffffffffffffff, 0x0) r1 = openat(0xffffffffffffffff, &(0x7f0000000600)='./file0\x00', 0x800, 0x8) ioctl$RTC_VL_READ(r1, 0x80047013, &(0x7f0000000640)) r2 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$EVIOCGBITSW(0xffffffffffffffff, 0x80404525, &(0x7f00000002c0)=""/164) r3 = creat(&(0x7f00000005c0)='./file0\x00', 0x136) mmap(&(0x7f00001b0000/0x12000)=nil, 0x12000, 0x1000008, 0x80012, r2, 0x0) setsockopt$inet6_MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, &(0x7f0000000380), 0xc) vmsplice(0xffffffffffffffff, &(0x7f0000000980), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(0xffffffffffffffff, 0x1, &(0x7f0000000680)=ANY=[@ANYRESDEC=0x0]) recvmmsg(0xffffffffffffffff, &(0x7f0000009880), 0x0, 0x0, &(0x7f0000009940)) clock_gettime(0x6, &(0x7f0000000800)) getsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, &(0x7f00000003c0)={{{@in6=@mcast1, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@ipv4}}, &(0x7f0000000240)=0xe8) sendmsg$nl_route_sched(r3, &(0x7f0000000500)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000004c0)={&(0x7f00000006c0)=ANY=[@ANYBLOB="240000002a000c012dbd7000fedbdf2500000000", @ANYRES32=r4, @ANYBLOB="2895050b00917fcc0677acfb2629579e3b8797ee7d736d4334b68d5afeb0039bc33e54183aa4a69d"], 0x24}, 0x1, 0x0, 0x0, 0x40010}, 0x8000) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f000000e0c0)={{{@in6=@dev, @in6=@loopback}}, {{@in6}, 0x0, @in6=@dev}}, &(0x7f000000e1c0)=0xe8) ioctl$sock_SIOCGIFCONF(r0, 0x8910, &(0x7f00000001c0)=@buf={0xad, &(0x7f0000000100)="4737fe38f5483563d90dbc2f02aa6b9317eb06faa9faa1b195fa3c342e53c3e5728fb12d6adbfeebe7c711382c7ea526ba83a0693692a7724368a4ba02c673727ef4a5434f6983aefdf243f42e704371ef47078f6cd3cf2cf8956d287959a4991fe0496c796fcaa2b516f9542bf7a5104d53ca0ca24643976fc316020beb7f65dc79e8325ef299e89df70b84362350b5b2b58fa9c18aad33e2dd3ae378a95d5683d7f71c79bd77d5eec384bdcf"}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f000000e800), &(0x7f000000e840)=0xc) write$selinux_access(r3, &(0x7f0000000540)={'system_u:object_r:wtmp_t:s0', 0x20, '/usr/lib/telepathy/mission-control-5', 0x20, 0x100000000}, 0x56) 03:37:14 executing program 1: r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r0, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040)) [ 468.369418] IPVS: Creating netns size=2536 id=114 [ 468.540508] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 468.554086] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 468.609737] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 468.622946] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 468.678832] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 468.692303] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 468.706683] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 468.721689] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 469.369475] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 469.403763] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 469.410293] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 469.418035] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:37:18 executing program 1: r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r0, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040)) 03:37:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f00000000c0)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8e03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e11f27730e90f2cd72b828", 0x1) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) write$P9_RVERSION(r1, &(0x7f0000000040)={0x15, 0x65, 0xffff, 0x1, 0x8, '9P2000.L'}, 0x15) ioctl$SG_GET_LOW_DMA(r1, 0x227a, &(0x7f0000000140)) sendfile(r1, r1, &(0x7f0000000080), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:37:18 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r1, 0x40505331, &(0x7f0000000040)={{0x3, 0x1}, {0x6, 0x4}, 0x2, 0x6, 0x7}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'bridge0\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:37:18 executing program 3: r0 = syz_open_dev$loop(&(0x7f0000000340)='/dev/loop#\x00', 0x4, 0x10000) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) ioctl$TCGETA(r4, 0x5405, &(0x7f00000002c0)) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="1b00040000007305cc5f09aa665cd611eb385faea4eaaf46076d5b7c90b8"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) getrlimit(0xf, &(0x7f0000000200)) r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$TIOCGPGRP(r5, 0x540f, &(0x7f0000000280)=0x0) r7 = getpid() tgkill(r6, r7, 0xc) ioctl$LOOP_SET_FD(r0, 0x4c00, r5) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:37:18 executing program 6: r0 = perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0xa, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000200)='/dev/ppp\x00', 0x40000, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000480)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)={0x18, 0x3b, 0xc, 0x70bd2a, 0x25dfdbfe, {0xc}, [@typed={0x4, 0x49}]}, 0x18}, 0x1, 0x0, 0x0, 0x800}, 0x0) openat$ipvs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/sys/net/ipv4/vs/pmtu_disc\x00', 0x2, 0x0) ioctl$LOOP_CTL_GET_FREE(0xffffffffffffffff, 0x4c82) r2 = memfd_create(&(0x7f0000000380)="3fbeaeec9b3af1bdd4c9adf22cb5234ab98cecf21f709d7c7e9c410369f3932b2f52008e7110949cf6704bde5ece3e8e02ba60d6851194b6e2a23f877fc79a4edd7616cdad8bdea2d4d31484a6ad2892c6c47ce2db4e082eab59759c9a131443f182e8f0d7db77984e0687c7cd", 0x3) pwritev(r0, &(0x7f0000000240), 0x1000000000000034, 0xfffffffffffffffe) fcntl$addseals(r2, 0x409, 0x8) ioctl$BLKIOMIN(0xffffffffffffffff, 0x1278, &(0x7f0000000100)) fcntl$notify(0xffffffffffffffff, 0x402, 0x0) fstatfs(r2, &(0x7f00000002c0)=""/157) ioctl(0xffffffffffffffff, 0x0, &(0x7f0000000280)="0a5cc8") lseek(0xffffffffffffffff, 0x0, 0x3) 03:37:18 executing program 7: r0 = socket$inet6(0xa, 0x1000000000002, 0x0) ioctl(r0, 0x8912, &(0x7f0000000280)="0a5cc80700315f85714070") r1 = socket$inet6(0xa, 0x1, 0x0) mmap(&(0x7f0000011000/0x3000)=nil, 0x3000, 0x1, 0x32, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000002000)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000001000)={{&(0x7f0000011000/0x3000)=nil, 0x3000}, 0x1}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_mreqsrc(r1, 0x0, 0x5, &(0x7f0000013ff4)={@dev={0xac, 0x14, 0x14, 0x11}, @rand_addr, @remote}, 0xc) getsockopt$inet_int(r3, 0x0, 0xe, &(0x7f0000000000), &(0x7f0000000040)=0x4) close(r3) dup3(r1, r2, 0x0) 03:37:18 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(0xffffffffffffffff) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:37:18 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) acct(&(0x7f0000000180)='./file0/file0\x00') read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x200}}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) r1 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0x0) keyctl$clear(0x7, r1) signalfd4(r0, &(0x7f0000000040)={0x7fffffff}, 0x8, 0x80800) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) 03:37:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x802) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r1, 0x0, 0x48f, &(0x7f0000000040)={0x0, @multicast2, 0x4e23, 0x800000000000002, 'fo\x00', 0x32, 0x4, 0x19}, 0x2c) openat$ion(0xffffffffffffff9c, &(0x7f0000000080)='/dev/ion\x00', 0x281, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f00000000c0)={0x0}, &(0x7f0000000100)=0xc) sched_setaffinity(r2, 0x8, &(0x7f0000000140)=0x43) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) [ 470.515250] binder: 19609:19613 ioctl c0306201 20000440 returned -14 03:37:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) setsockopt$inet_MCAST_LEAVE_GROUP(r1, 0x0, 0x2d, &(0x7f0000000040)={0x3, {{0x2, 0x4e21, @multicast2}}}, 0x88) 03:37:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:18 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, &(0x7f0000000000)=0x0) fcntl$lock(r0, 0x7, &(0x7f0000000040)={0x2, 0x2, 0x9, 0xa2b, r1}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:37:18 executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(0xffffffffffffffff) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:37:18 executing program 7: r0 = perf_event_open(&(0x7f000025c000)={0x1, 0x70}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x8005, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, r0, 0x0) read(r1, &(0x7f0000000040)=""/91, 0x5b) lseek(r1, 0x0, 0x1) r2 = syz_open_dev$usbmon(&(0x7f00000000c0)='/dev/usbmon#\x00', 0x7, 0x40) r3 = socket$l2tp(0x18, 0x1, 0x1) epoll_ctl$EPOLL_CTL_DEL(r2, 0x2, r3) [ 470.572832] binder: 19629:19636 ioctl c018620b 20000040 returned -14 [ 470.597353] binder: 19626:19630 ioctl c0306201 20000440 returned -14 03:37:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) [ 470.650062] binder: 19647:19649 ioctl c0306201 20000440 returned -14 [ 470.674490] device lo entered promiscuous mode [ 470.683905] binder: 19652:19665 ioctl c018620b 20000040 returned -14 03:37:18 executing program 7: r0 = openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) getsockopt$inet_int(r0, 0x0, 0x8, &(0x7f0000000280), &(0x7f00000002c0)=0x4) syz_open_dev$usbmon(&(0x7f0000000240)='/dev/usbmon#\x00', 0x0, 0x604800) r1 = socket$inet(0x10, 0x80002, 0x0) r2 = syz_open_dev$usbmon(&(0x7f0000000100)='/dev/usbmon#\x00', 0x80000000, 0x143000) socket$nl_route(0x10, 0x3, 0x0) sendmsg(r1, &(0x7f0000004fc8)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="2f0000001800030007fffd946fa283bc8020000000040005031d856813000900083c14cc16ccbb24e0710b42fa3ccc", 0x2f}], 0x1}, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) fcntl$getownex(r2, 0x10, &(0x7f0000000880)) getegid() r3 = socket(0xb, 0x802, 0x0) write(r3, &(0x7f0000000140)="fc00000049000700ab092500090007000aab0700000000001d00369321000100ff0100000005d0000000000000039815fa2c1ec28656aaa79bb94b46fe000000bc00020000000000000000272f2e117c22ebc205214000000000008934d07302ade01720d7d5bbc91a3e3280772c05defd5a32e280fc83ab82f605f70c9ddef2fe082038f4f8b29d3ef3d92c83170e5bba4a463ae4f5566f91cf190201ded815b2ccd243f295ed94e0ad91bd0734babc7c3f2eeb57d43dd16b17e583df150c3b880f411f46a6b567b4d5715587e658a1ad0a4f01731d05b0350b0041f0d48a99c03f080548deac270e33429fd3000175e63fb8d38a873cf1587c3b41", 0xfc) 03:37:18 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f0000000040)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) [ 470.701282] device lo left promiscuous mode 03:37:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) r2 = fcntl$getown(r1, 0x9) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000600)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r1, &(0x7f0000000500)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000400)={&(0x7f0000000480)={0x74, r3, 0x800, 0x70bd2a, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x2}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x80}, @IPVS_CMD_ATTR_DEST={0x48, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv6=@ipv4={[], [], @broadcast}}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x7}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x3}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x2}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x4}]}]}, 0x74}, 0x1, 0x0, 0x0, 0x800}, 0x40000) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000100)={{{@in6=@local, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@ipv4={[], [], @rand_addr}}, 0x0, @in6=@ipv4={[], [], @multicast1}}}, &(0x7f0000000200)=0xe8) fstat(r1, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000240)={r2, r4, r5}, 0xc) sendfile(r1, r1, &(0x7f0000317000), 0x80) getrusage(0x0, &(0x7f0000000040)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) [ 470.771492] binder: 19669:19672 ioctl c018620b 20000040 returned -14 [ 470.839768] binder: 19674:19679 ioctl c0306201 20000440 returned -14 [ 470.862582] binder: 19674:19686 ioctl c0306201 20000440 returned -14 03:37:18 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') clock_gettime(0x0, &(0x7f0000000280)={0x0, 0x0}) futex(&(0x7f0000000200)=0x1, 0xf, 0x0, &(0x7f00000002c0)={r5, r6+10000000}, &(0x7f0000000300), 0x2) ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:37:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:18 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(0xffffffffffffffff) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:37:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x100000000004, 0x11, r1, 0x6) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) syz_open_dev$binder(&(0x7f0000000040)='/dev/binder#\x00', 0x0, 0x800) 03:37:18 executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(0xffffffffffffffff) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) [ 470.994356] device lo entered promiscuous mode [ 471.000230] device lo left promiscuous mode 03:37:18 executing program 7: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) acct(&(0x7f0000000180)='./file0/file0\x00') read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x200}}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) r1 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0x0) keyctl$clear(0x7, r1) signalfd4(r0, &(0x7f0000000040)={0x7fffffff}, 0x8, 0x80800) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) 03:37:18 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x400) ioctl$UI_SET_MSCBIT(r1, 0x40045568, 0x37) [ 471.069607] binder: 19698:19700 ioctl c018620b 20000040 returned -14 03:37:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:18 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) write$FUSE_NOTIFY_STORE(r1, &(0x7f0000000140)={0x2a, 0x4, 0x0, {0x5, 0xe8, 0x2, 0x0, [0x0, 0x0]}}, 0x2a) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000100)='scalable\x00', 0x9) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$SCSI_IOCTL_BENCHMARK_COMMAND(r1, 0x3) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) keyctl$session_to_parent(0x12) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r1, 0x40a85323, &(0x7f0000000040)={{0x40, 0x80000000}, 'port0\x00', 0x4, 0x800, 0x921, 0x9, 0x5, 0x8, 0x400, 0x0, 0x1, 0x9}) 03:37:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) [ 471.170337] binder: 19714:19715 ioctl c018620b 20000040 returned -14 [ 471.187467] binder: 19710:19717 ioctl c0306201 20000440 returned -14 03:37:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f", 0x5) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:19 executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_mreq(r0, 0x29, 0x1f, &(0x7f0000000080)={@mcast1}, &(0x7f0000000100)=0x14) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r2, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) write$FUSE_INIT(r2, &(0x7f0000000200)={0x50, 0xfffffffffffffffe, 0x3, {0x7, 0x1b, 0x9, 0x80020, 0x62c, 0x80, 0x4f, 0x2}}, 0x50) accept4$unix(r2, &(0x7f0000000180), &(0x7f00000000c0)=0x4d5, 0x80002) setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f0000000480)=ANY=[@ANYBLOB="66696c746572000000000000000000000000000000000000000000000000000007000000040000008004000060020000000000000000000098030000980300009803000004000000", @ANYPTR=&(0x7f0000000040)=ANY=[@ANYBLOB="000000000000000500000000000000001e00800000e759434f2511a54f307c7b6de0ae00000000010000000000000000000000000000000000000000000000c2"], @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f000200100000000000000000000000000000000000000000000000000003000434f4e4e4d41524b0000000000000000000000000000000000000000000104000000060000000600000003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0004001000000000000000000000000000000000000000000000000000050006d616e676c65000000000000000000000000000000000000000000000000aaaaaaaaaa0a0000000000000000000000000000000000000000000000000000ac1414bbac1414bb0600000000000000ac1414bbac1414bbffffffffff00000000000000000000000000000000000000000000000000000000ff0000ffff00000000000000000000aaaaaaaaaa1e0000000000000000000000000000000000000000ff0000000000000000000000000000d00101040000070026ffff6772657461703000000000000000000069726c616e300000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000000000000000ff0000000000000000000000000000000000010000000000000000000000f0003801000000000000000000000000000000000000000000000000000048004c454400000000000000000000000000000000000000000000000000000073797a300000000000000000000000000000000000000000000000000400000007000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c000e8000000000000000000000000000000000000000000000000002800000000000000000000000000000000000000000000000000000000000000feffffff00000000"], 0x4d0) sendfile(r2, r2, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) [ 471.220454] binder: 19710:19723 ioctl c0306201 20000440 returned -14 [ 471.230058] binder: 19721:19724 ioctl c018620b 20000040 returned -14 03:37:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) r2 = syz_open_dev$sg(&(0x7f0000000040)='/dev/sg#\x00', 0x0, 0x2) ioctl$SG_NEXT_CMD_LEN(r2, 0x2283, &(0x7f00000000c0)=0x4b) write$binfmt_elf64(r2, &(0x7f0000000300)={{0x7f, 0x45, 0x4c, 0x46, 0x6, 0x3, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, [{}]}, 0x78) r3 = socket$inet6(0xa, 0x3, 0x1) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x3, @ipv4={[], [], @rand_addr=0x9}, 0x9}, 0x1c) bind$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x7fff, @dev, 0xfffffffffffffffd}, 0x1c) r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/enforce\x00', 0x101000, 0x0) ioctl$TCSETS(r4, 0x5402, &(0x7f0000000100)={0xffff, 0x11c9, 0x2000000000000000, 0xffff, 0x5e2, 0x100, 0x0, 0x1}) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000180)='/dev/vga_arbiter\x00', 0x40800, 0x0) ioctl$TIOCLINUX7(r4, 0x541c, &(0x7f00000000c0)={0x7, 0x400}) ioctl$RTC_UIE_ON(r2, 0x7003) sendmmsg(r3, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f00000000c0), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="0c00000000000000000000000000009429dcc2a5d5293e0c66fe08"], 0x18}, 0x1f}], 0x1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) [ 471.271629] binder: 19727:19730 ioctl c018620b 20000040 returned -14 [ 471.317345] binder: 19737:19738 ioctl c018620b 20000040 returned -14 [ 471.366747] binder: 19739:19740 ioctl c0306201 20000440 returned -14 [ 471.378444] binder: 19739:19740 ioctl c0306201 20000440 returned -14 [ 471.403166] device lo entered promiscuous mode [ 471.414471] device lo left promiscuous mode [ 471.481630] device lo entered promiscuous mode 03:37:19 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="66643d1b8081b10c988431c773e1ecbd59b585b38772408f96df65523ff35e2ce7ef25e05fb71fcb6d58a18db775e9e8e4063bd77ab4116a763b6da94d53613287b8695de792d9e72149cf7619975e7769100a34783e5fb1e40b8fa6", @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) r1 = open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) lstat(&(0x7f0000000040)='./file0\x00', &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000000680)='./file0/file0\x00', &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_ENTRY(r1, &(0x7f00000005c0)={0x90, 0x0, 0x2, {0x6, 0x0, 0x80, 0x3, 0x3, 0xa9, {0x1, 0x7, 0xa87, 0x99, 0x5, 0x7, 0xb4dd, 0x432d, 0x61, 0x70, 0x100, r2, r3, 0x1ff, 0x7fffffff}}}, 0x90) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) ioctl$SCSI_IOCTL_PROBE_HOST(r1, 0x5385, &(0x7f00000006c0)={0xf9, ""/249}) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) mount(&(0x7f00000000c0)='./file0/file1\x00', &(0x7f00000007c0)='./file0\x00', &(0x7f0000000800)='ceph\x00', 0x40000, 0x0) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) ioctl$RTC_IRQP_SET(r1, 0x4008700c, 0x1436) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) fcntl$dupfd(r0, 0x406, r1) 03:37:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:19 executing program 7: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) acct(&(0x7f0000000180)='./file0/file0\x00') read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x200}}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) r1 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0x0) keyctl$clear(0x7, r1) signalfd4(r0, &(0x7f0000000040)={0x7fffffff}, 0x8, 0x80800) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) 03:37:19 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x2) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) lremovexattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=@random={'user.', '/dev/binder#\x00'}) sendfile(r1, r1, &(0x7f0000317000), 0xff8) r2 = mmap$binder(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x8, 0x80010, r0, 0x4e) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x9c, 0x0, &(0x7f00000001c0)=[@clear_death={0x400c630f, 0x3, 0x1}, @acquire, @transaction_sg={0x40486311, {{0x1, 0x0, 0x1, 0x0, 0x11, 0x0, 0x0, 0x40, 0x10, &(0x7f0000000140)=[@fd={0x66642a85, 0x0, r1, 0x0, 0x2}, @ptr={0x70742a85, 0x1, &(0x7f00000000c0), 0x1, 0x4, 0x9}], &(0x7f0000000180)=[0x18, 0x20]}, 0x52a5}}, @request_death={0x400c630e, 0x4, 0x4}, @clear_death={0x400c630f, 0x1}, @register_looper, @increfs_done={0x40106308, r2}], 0x0, 0x0, &(0x7f00000003c0)}) [ 471.664497] binder: 19750:19755 ioctl c018620b 20000040 returned -14 [ 471.675034] binder: 19753:19754 ioctl c0306201 20000440 returned -14 [ 474.869118] IPVS: Creating netns size=2536 id=115 [ 475.116923] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 475.130860] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 475.561934] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 475.577569] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 475.632805] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 475.646493] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 475.660804] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 475.675904] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 476.427391] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 476.463256] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 476.469595] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 476.476923] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:37:25 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:37:25 executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(0xffffffffffffffff) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:37:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:25 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = getpgrp(0xffffffffffffffff) r5 = getpgrp(r4) sched_setattr(r5, &(0x7f0000000200)={0x30, 0x1, 0x0, 0x0, 0x8d, 0x1ff, 0xfffffffffffffff9, 0x8}, 0x0) ioctl$TUNSETNOCSUM(r2, 0x400454c8, 0x1) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="03c747ab3619861256000e0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r8 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') write$P9_RREAD(r7, &(0x7f0000000400)={0xe3, 0x75, 0x1, {0xd8, "2f1667bccd47a0edf07103fd5d266ed4dc63cb361f02540b33fe906d496ec82169071d547d1726ce60fca7243b4352287b5b9ad17e71fa47c7c6226b4803ef78e4b8c78a3548fc00b0ddaaabc049dfb7ac053e8e635a522c423c8b379b8b982e179f20e373c3105f17e2097c44983a1834b9a73f3015249cc5ed081d2d76195dcb5495b7c9c4576bdc6e8d44fdd2c45cd0fcb477cd64f0b76fdef66538f52da92c91906396a7fa074af915d4a954bed66fe76e61befcc9e4f7247b53171153f2665ce45fa31646c494dd40b1a49d6d99b9da0f694c13785d"}}, 0xe3) ioctl$LOOP_SET_FD(r0, 0x4c00, r8) ioctl$EVIOCGEFFECTS(r6, 0x80044584, &(0x7f0000000280)=""/177) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:37:25 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r0 = socket$inet(0x2, 0x802, 0x9) ioctl$sock_inet_SIOCSIFNETMASK(r0, 0x891c, &(0x7f0000000040)={'nr0\x00', {0x2, 0x4e22, @loopback}}) ioctl$sock_inet_SIOCSIFFLAGS(r0, 0x8914, &(0x7f0000000000)={'\x00', 0x2000}) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) 03:37:25 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) r1 = open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0xffffffffffffffff}}, 0x50) ioctl$TIOCGETD(r1, 0x5424, &(0x7f0000000040)) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) 03:37:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:37:25 executing program 7: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) acct(&(0x7f0000000180)='./file0/file0\x00') read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x200}}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) r1 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0x0) keyctl$clear(0x7, r1) signalfd4(r0, &(0x7f0000000040)={0x7fffffff}, 0x8, 0x80800) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) 03:37:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000040)=[{0x4, 0xffff}], 0x1) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) [ 477.588274] binder: 20142:20152 ioctl c018620b 20000040 returned -14 [ 477.609141] binder: 20145:20148 ioctl c0306201 20000440 returned -14 [ 477.620349] binder: 20145:20156 ioctl c0306201 20000440 returned -14 [ 477.640467] device lo left promiscuous mode 03:37:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883", 0x3) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000300)={{{@in6=@dev, @in=@rand_addr, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast1}, 0x0, @in6=@local}}, &(0x7f0000000400)=0xe8) getsockopt$inet6_mreq(r1, 0x29, 0x1f, &(0x7f0000000480)={@loopback, 0x0}, &(0x7f00000004c0)=0x14) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000500)={'ip6tnl0\x00', 0x0}) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000540)={'team0\x00', 0x0}) getpeername$packet(r1, &(0x7f0000000640)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000680)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f00000006c0)={{{@in6=@ipv4={[], [], @multicast1}, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@loopback}, 0x0, @in=@dev}}, &(0x7f00000007c0)=0xe8) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000008c0)={{{@in=@loopback, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in=@broadcast}}, &(0x7f00000009c0)=0xe8) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000a00)={'team0\x00', 0x0}) getsockopt$inet6_mreq(r1, 0x29, 0x15, &(0x7f0000000a40)={@ipv4={[], [], @local}, 0x0}, &(0x7f0000000a80)=0x14) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000ac0)={'team0\x00', 0x0}) accept$packet(r1, &(0x7f0000000bc0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000c00)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000c40)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in6=@remote}}, &(0x7f0000000d40)=0xe8) getsockopt$inet_IP_IPSEC_POLICY(r1, 0x0, 0x10, &(0x7f0000000e40)={{{@in6=@loopback, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in=@rand_addr}}, &(0x7f0000000f40)=0xe8) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000f80)={{{@in=@multicast2, @in6=@mcast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@loopback}}, &(0x7f0000001080)=0xe8) sendmsg$TEAM_CMD_NOOP(r1, &(0x7f0000001640)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10800180}, 0xc, &(0x7f0000001600)={&(0x7f00000010c0)={0x508, r2, 0x500, 0x70bd27, 0x25dfdbfd, {}, [{{0x8, 0x1, r3}, {0x184, 0x2, [{0x4c, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x1c, 0x4, [{0x2, 0x8, 0x6, 0x1}, {0x400000000000, 0xfffffffffffffffa, 0x2, 0x80000001}, {0x9, 0x5, 0x1e2780000000000}]}}}, {0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0x2}}, {0x8}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x4}}, {0x8, 0x6, r4}}}, {0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x7fff}}}, {0x3c, 0x1, @user_linkup={{{0x24, 0x1, 'user_linkup\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r5}}}, {0x40, 0x1, @lb_tx_hash_to_port_mapping={{{0x24, 0x1, 'lb_tx_hash_to_port_mapping\x00'}, {0x8}, {0x8, 0x4, r6}}, {0x8}}}]}}, {{0x8, 0x1, r7}, {0x4}}, {{0x8, 0x1, r8}, {0x214, 0x2, [{0x54, 0x1, @bpf_hash_func={{0x24, 0x1, 'bpf_hash_func\x00'}, {0x8}, {0x24, 0x4, [{0x0, 0x101, 0x7, 0x24b}, {0x19, 0x3aa, 0x400, 0x101}, {0x1000, 0x5, 0xfffffffffffffff7}, {0xee7c, 0xa5, 0x2, 0x7}]}}}, {0x44, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x14, 0x4, 'activebackup\x00'}}}, {0x4c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0x1c, 0x4, 'hash_to_port_mapping\x00'}}}, {0x3c, 0x1, @enabled={{{0x24, 0x1, 'enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r9}}}, {0x38, 0x1, @activeport={{0x24, 0x1, 'activeport\x00'}, {0x8}, {0x8, 0x4, r10}}}, {0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8}}, {0x8, 0x6, r11}}}, {0x38, 0x1, @mcast_rejoin_count={{0x24, 0x1, 'mcast_rejoin_count\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffc00}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0xd7b}}, {0x8, 0x6, r12}}}]}}, {{0x8, 0x1, r13}, {0xec, 0x2, [{0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xfffffffffffffff8}}}, {0x38, 0x1, @notify_peers_count={{0x24, 0x1, 'notify_peers_count\x00'}, {0x8}, {0x8, 0x4, 0xfff}}}, {0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0xffffffff}}, {0x8, 0x6, r14}}}, {0x38, 0x1, @notify_peers_interval={{0x24, 0x1, 'notify_peers_interval\x00'}, {0x8}, {0x8, 0x4, 0x8}}}]}}, {{0x8, 0x1, r15}, {0x44, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x7fff}}, {0x8, 0x6, r16}}}]}}]}, 0x508}}, 0x4) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) [ 477.682504] binder: 20160:20162 ioctl c0306201 20000440 returned -14 03:37:25 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000040)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) 03:37:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a8", 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:25 executing program 7: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) acct(&(0x7f0000000180)='./file0/file0\x00') read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x200}}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) r1 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0x0) keyctl$clear(0x7, r1) signalfd4(r0, &(0x7f0000000040)={0x7fffffff}, 0x8, 0x80800) [ 477.746924] binder: 20173:20174 ioctl c018620b 20000040 returned -14 03:37:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) [ 477.797452] binder: 20176:20178 ioctl 8933 20000ac0 returned -22 [ 477.809874] binder: 20183:20184 ioctl c018620b 20000040 returned -14 [ 477.848725] binder: 20186:20190 ioctl c018620b 20000040 returned -14 [ 477.850146] binder: 20176:20178 ioctl c0306201 20000440 returned -14 [ 477.864067] binder: 20176:20192 ioctl 8933 20000ac0 returned -22 03:37:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) [ 477.880523] binder: 20176:20178 ioctl c0306201 20000440 returned -14 [ 477.924647] binder: 20195:20198 ioctl c0306201 20000440 returned -14 [ 477.988596] device lo entered promiscuous mode [ 477.994351] device lo left promiscuous mode 03:37:25 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f00000001c0)="2d42d54e49c56aba707070f0081772392ebbf10f782ef3fd76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe390fe7d924ce20ab4eaec9bdd36740e127730e90f2cd729828", 0x2) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) [ 478.117748] binder: 20209:20210 ioctl c0306201 20000440 returned -14 [ 478.126273] binder: 20209:20210 ioctl c0306201 20000440 returned -14 [ 478.162801] IPVS: Creating netns size=2536 id=116 [ 478.371612] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 478.387230] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 478.446763] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 478.461016] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 478.518944] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 478.533006] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 478.548162] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 478.563472] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 479.240177] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 479.273961] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 479.280163] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 479.287749] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:37:28 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) r1 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000180)='/proc/self/net/pfkey\x00', 0x20000, 0x0) ioctl$TUNGETIFF(r1, 0x800454d2, &(0x7f0000000240)) r2 = open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) write$P9_RSTAT(r2, &(0x7f0000000300)=ANY=[@ANYBLOB="450b186df4010000003e0001010400000008020000000400000000000000ec9006114c302952250a4249a300002005050000000400000000040000000000000200666401002f0700757365725f696401002a"], 0x45) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/sequencer\x00', 0x105000, 0x0) setsockopt$inet6_buf(r2, 0x29, 0xd2, &(0x7f00000005c0)="772edd4047995b2a28e6675540bf3b2bdbcbf84028436c5169603cd95d2fac772857cd04a089386666540ad78f6db1dc758c7105459a13e2637fc507694ad74e4fd44c13c9d66f6aac53905f4b5c2c3fd2da02cc546beaac0e632c2a3d72de8c1762dea53dfbc14bbed79e2180297555b79c8ccddad1f4028695dfdc8c98ca77f0343652a623d6a4367ae7bc79f2d0bdd39618fa09c871b8a759c3a9b4e64d8c35b332f8a8cbd7ff5caf8e73307851a047c70c9f6e08154846f31d3b02639d270f9eca69e339c55780f7c6395938888e66e3a7", 0xd3) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) 03:37:28 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:37:28 executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(0xffffffffffffffff) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:37:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) r2 = ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, r2) sendfile(r1, r1, &(0x7f0000317000)=0x1, 0x8000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) renameat2(r1, &(0x7f0000000040)='./file0\x00', r1, &(0x7f0000000080)='./file0\x00', 0x6) 03:37:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x220000) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:37:28 executing program 7: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) acct(&(0x7f0000000180)='./file0/file0\x00') read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x200}}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) r1 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0x0) keyctl$clear(0x7, r1) signalfd4(r0, &(0x7f0000000040)={0x7fffffff}, 0x8, 0x80800) 03:37:28 executing program 5: r0 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) write$binfmt_misc(r0, &(0x7f0000000540)={'syz1', "6b56c40329843b12c10c849c07a138e73630ea93caa96b07a837472412bc798459afd213c1f0fe16aab3ea329bc70e216a853f109d838129abac7dbc34a10b74b280c7ded39517b93cfc92660eee76cda090b134961ee979a69c20cd57cd2381aecd830f04e8c74fa63b3d505e13eb12833a219ad1678741df7eae9491171ca7874c955fde4c2bd29e6b81bd23d6b083587849c6442fdc52f66f99bc2811647b6cfdfde611915a9d0aeaa6c1f34baf345b72a1e91a3fd7824a7079dbf5a6d750d77c546605055f9669385e770df3b3bede97b2c0d0cc6bee05eccda3a873d4e77bebac1171ed06c20463a13f99255bb033ed3c8e5d53cb03bd2e24be4b7b40d379a3a88f5bb9ea47b5303db8d580e31b07e6c739d78bbfb5342e81be2a5b94cf7fa929c40d4e5ed6f550c3764604f3aa7e09002dc5dc76866e378254edd8858b80714660e2c6c8712110a97c90d5ef4c357307aa8c378b50e963f45ecf7ee9b0bfd083d2b8a928665fc1a2d7a8bc880145f4cb00df7e4ecfb27cbef26191bf26042d84dea532eff1b827bb083c864be4c649711c2eeb75ab29d3eb41f25343f95956adc560af762fbe0027f60537986201fc0d78d3f5860eedda2b37a328124c250395a14ea9f1e431f81dcacd9988a7fc37594cb2c7f26463a39babdaf9c46815a774c435bffe2ad95dc65b579cf3791163279a97ba7d8bc579c939aa6c756f0267fce038f2b723b7fd927c1a2e76959ca3013fb7d5b2aea357a5c92176c5b1bfb12027f1348e7798cea00b4002aa2d0af7999cb33b7a4e0b5c0c2c658825066d66bb220612308baf109f9cf0b1a244850a3b713b04f9c17f28a3740fe4555aa3fa77312fc7494d5d6efffc0008661fe0a9644d7b24b1d09ea7e5b4932241e2b017088df1de94f9829cae5aba6fb229ac433d2261275c9b9e36e4f0a948fbfe648d2844b245a5b1a8bb39f92f6920e4890b8a43e449281dccdece7fc329b8472f840c11619b442c4a2a2b894a8f3a9686479e6608d5ead062e08caee2ea4010f491973798de9990cfe561be818b7c1ce15e6eb9f41211f499721aef6dbb185f760f4a382bf15788766b3abd855aa1d0e2a451161f0f74019430d88823f27e4d11f10a0645176c1ce702cfb3bdd534a3487272f0f45d2293636571497e14ea2618b7080a8abafe7fb2ac9ca652c03959f4aaf51976d215eeb9d3ceeb1830841be72d9a972a264caff2bce078f5f3005c416b334ebdee7d7e7cde2c2a5795d7e6c9096d719cd9fba621611e2bb886ccc0ecb144ce696765033105f09c323ffa339bf2a420e92a987dab48b275c5989430726c38b47b3e968f149c1a09781819e0b50ddd43ed0db088df6eb5763b4c2afd3cfb85ec90af6af6a8081d8c1b0ab63fc30b254399f8c7a2f81ee8c9342ece075965aec5230e89c363ba265312c584d6738e24ce686b42d0f5c1691f26061d195c84881d2eb1004562a2a3dee697a6c7d477469fc011f4a5f9b1fba621ab997b856b3dbdcd377bcfbf82ada9ad823e4a4bbd36a7b0f287fbf129c1c9e5718dfc8a4051a0c40845c3f87be64712c7303cc0f08a2d0b2df5cceb4b50e9198ec621bfe96d516cddd4ef07988601eebaa4bf0e619224824b65154d1ce96c2c02c2e2dd63a621ac162806022d8e83b4de8d3a26a7d44ae09af21413d0a1e14ed4837f3dd663df25e3eb18a54fbcc1591bf3382ae99d677cc58cf3fd14991a11de38f989195b59689edd4e2fc52349987c2eda14448977cb25a9ec935763d7fbce346282012d876bf59466d9dc0e9211302c329582aa600bc8bf317e9db356bc33aa0ee1fdd1091891880faec3402d48df4e4d9e6995e9b972de4b708e2ced6d212e2c0e73dd4f75abe15685865fdd9062bb8d0c1ca2d69b67c74ab521412f352a9f1fa9b9762abac2e7216e0b192f84fdd1040cd4797c911c90bc2f33396ba1b39812e01207aa3d802f89fdc3d473db98dcd712c9efb269d9f9bcf1d64b44d7235eed3180528682a4dec87bbe6568811729db99e66d31dbaa95dab39fd4e044ee3881e41cc14a1df688ace8e2bbba12d2ef6badd86e8e057192ddd485c8b2b45a7834a35d385b56f94408d12a3ff0afe9c50203f78af7326344feaf4ef0dccf653c1b8c5813f2de3028daf184f49516f601cf54262217b103733fae8b51d42ba5609e9fce36269ea157d4ce99a72c6ed6135f1bbe41bf17c819677d643a7c7972dc8a4824552699236987548d1a47f82460f23734b776483d4ed9746e4f940b5e6a15f3bae2c6e4252a2b05db7453f5ba0012adce88df95fd92dce2d82a4035a2172e8894f2a72e9261f35ed2121f03477a6c8926b2c7bc3126293af869f51f751361425086bde9e4a9b93f9f80f9c6156ea9aa6828037909a0d0f23d884ad90f13b31bea863239216e8e569ae6e6a7742af8726f4acc7812c373f839cbd548d8f4af541a29db6bda6199755b87b76c591a87963582bba6bb0f9124ba966bf372cba265a918370e5b6a472c3dd1a5bb5c9f63c360a3f48dd1453bab9365426a9a763fa6b80647fa9d1b198f6b4dabef1ede8a883c35b3eb2a9455e968b3b80aa7d09d797717a95df416492ca1add2f8a84df1cfd29b204b4310fcdfb76516162c86e3f365bb226cdca327b6830160c43791ff979d1bee8fa457a9c9b93131869fc8e1107fd8a0701e0c409f2305731f83efb5981e7eab190dddd1818ac08041317489e0677628729d88abaf9ad5f958db03207ee5262225b12f5eda80cfb523653417632193e3c5602a0fdb0c6c0c48ab141f879467184fcadd9dc29005889a40860a0b7a1a874da89bc037ccada76e25af077844cd92b465965370c19f5edacb464b08e9bc046085848a50892318831c4d6589d3daf4e1a3361ee7001e1593f3de837f84abc1ea167d2e1d664d77145a05231714460cb98c7bf09f571e0205685381e8c0988cad2f32667f285963a2d0a9d394036e4a0da2f3c6971d7e7c3735c4d949e2c47a51731d0181d34c7c0c18fbdb0a157c6d25df1c52b207572c0625d630cdcec4b98fe778264270e5a0089affe4a0513eef6989868aa5d99f7fe6fb0e38daee4417cf8394315f9cd2b8a4a123acbd97ddbe65c077fd1afe2ee158c2f0f7db61ac0a484fdd353a4fd4c4702378e2e6ec0029e0573d0de7064ca2af5fda9cb47a3c95aab0bd3b70d4af09d015ac0f31bd41d6b973d1d6b9a1c1cc1d8186f257ff02b7775e1ed5f3f1ba66744974f1b431ec350e005577c7d8d4fc2797cf694f0f0514154f328db8cde7c58abeec50f3c95123d3ae897667e93c964f0909593e41efb2e61a26f04b260e8a5b1fefe9b66b7c3e48bcc0572116944cd56e720f7dad3a7da677e9200369c339d9d7988739edd6524b96aec895e615b7168357a294105d760a41f8abbe00b2464be4b05f6d0381afe4243c628ef529f048d837785bb8fb9ce480d2b32b52ac972734ecdd0a750e905bdf8074e8c5b3e8e52b85171179b94a9a09e82e801b5ff319eac18795f64f3caf9ff8a6ee6c805b6338058961be8c7047ed98dd30ec7a6b259e1572bb332556a287823fc63054f03b449e8c76a8e5b474411f80708e9b1aa720a205d87e222769a7bdf856c2a7decca960d8124714b1963910318334e51da83cb757feb62755def3edf41dbe55820610c8f7ca0d519ecb6f6fc1421591aabcff10829e0cd4a4177d6e97b2eb85e955a26bf7d2736fdcc4cd4610e1442e176923d3fce257a21c21dd95d021217e572db85a180ce5aec168c9c4cc2fe35e2a111ca76fb6da1c160385329703dc02b8af9e65982005902edf178abc8ae759cbc0f1abcc7cc903083ed7466ad1aacfe4cdec0e36bfcfef600378e001473541bf00e1078f2d8de7df29b65b9a36d7486618ef1b8f5659b0df2327c63b16d40d89f6621ca6dba0aef6face773db7cf6c606733d6ef60004bf4d937b8e2dc99e9f9925ff15c2454664b75ec3f397f9f6ff3dc98187d6684886a7746dcf7472b861702448b47c41270f508d346f737cfd6947c82d86bd23a4cd1059c2f5dc8ccc72697b320fab50ce40b129d46286204e1ae2c42f26881a0c44c02355361886d51fa32ca931f28bea87edd1a440ee9b54156ae398d230be86cb86c536a4d9e08e7091519094ee25d08826ff23f2cb66b7aae341a76e6b1a58d033029767ebe12675ed89e881c039c44d8eaa06eacd21e342f3a3301287ab747aa7f28f74ad394e3a9bb6573482496213bf6b24176e85dec584358839ba08a04f22121621a9be81e934ac84e8893d7089403608954303fc455612ddb775fd63c9276cd81a390636794955411e1656f90a6d45aaba1a78f82ce24177602d6dd9e01545d1abf55de9288de9e20ad73b5c1380a6fecca64c887ea4f08cded065182b8e2a1b177e4b13bfc3292f4949ef890ee5988dbf68d1dbd026b354097a29bc1584d311db6b6fd1e89cfce47cae6a4c72df3bf2eaa232f4c1da393a3a5673d703fb7ed4bc843ced2e99266908bda333d4aab5947870cf48aee19de11d35b34fcd4f1deb38141471636ad449c14f28549a5819ec1296944fcbd0143965b8f737808a531b150f001369d530e2fe3801cd3688715f9186c52eb1161167e7f2dd3588904ba7e70594787fd74eac73976bca0077753b965f69da1cd32b0616f8e2306e8ac8e1d143c8a0b85470dfa574162de7b6abd37534d5f483480a38ad1b055cf941eb45cf2d6e94f82b02ba7a490bdbcc8b8aff850979d44ab78f92e76062394e45fd1aa029e71517d4c6caea98db4477d865ade68475012a23009815595e9ec6a25116ab88f771650625c9264ec09e637448c6b9d5626f1fa22e74bae4f6f0f3e73cfb775d6a9474e622eda67b8d8327913fee4829719624f6c6bd163c5260443e6dbb60f54d41a22a13ad8c7e0403f0e723707168623f642789fad1eb4b6d14cdad5004997bb3e2e889463bf1a38f25523e9409a053157e5d6e0313bcbecd53fbbf1639821545b012a6a6460dd3655c77c43e634dcd3f5bb17ead079df03c0d131eed178785efc796cbacd650bd2fcf1881b3aef3270ba45b84836740e880c5ea462080ae73108049af3ebaf67d190c5465f2b444fc24292db33c7472e94afddea1ac99339b6318f73c781c14e0fb89845e926db4263c7b3ab28e30d7fca46be4a08fd6eccafe4a7f641eae7c42690c0c5d1b3124711463b68d85e68418b0a3b955f4cc07ce8afcf994295be6310a719ae60991b3e5d939656301ce0b83b90151ac475c934d31694e16100705b56155ecbc2d1442c12d78557e1d17b63a2988c4090eebe14a4acc610c06a93c27ce4c50b097f2379e3d9e1c22b3acafc8a78aa426eb18368d81bea4b676b0c6e0937819802786f8cac4275df3c3ec094da0a47a630c5277cf20aa300b4ffc3fe29a84170f2173abc741bfdbd02165cd883dba1233a6b2bf0690d0d53e82cb791e1f094749d7b745dd3426a1b19731882bf5b9480c4d0848cd7c0b77da36d3d04cf9c2731a380c031da846340d43610e554f7642763fd62664de80ec0a57f25705e46b17b815b4bce14e3644a81129b3c93baae7521c389fb9794f6660f7def26fe53c2eb8eafe35ec19327c9c7b89be2f8f507eb5963388c8fdbe00205d9aa9500b8176ff82cbd194675469e63b6955a48c13b6f367a61bb436239e1ea45bd844adadd19ab2d44e4059fcfae5c6fb902d1bb5894c37e56cdc0313b109d93f2a22f038ba827f1499dcb2887561dca3133734c1d5c4f12cd43a7cee3afb7041f"}, 0x1004) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x1400}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200"}) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, &(0x7f0000000000)={0x2c, @loopback, 0x4e23, 0x2, 'none\x00', 0x2d, 0x9, 0x67}, 0x2c) [ 480.374912] binder: 20591:20598 ioctl c018620b 20000040 returned -14 [ 480.385503] IPVS: set_ctl: invalid protocol: 44 127.0.0.1:20003 [ 480.397770] IPVS: set_ctl: invalid protocol: 44 127.0.0.1:20003 03:37:28 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$TIOCLINUX7(r0, 0x541c, &(0x7f0000000040)={0x7, 0x7fffffff}) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0x1001}) 03:37:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000), 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) [ 480.422185] binder: 20592:20605 ioctl c0306201 20000440 returned -14 [ 480.451196] device lo entered promiscuous mode [ 480.465044] device lo left promiscuous mode 03:37:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a8", 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:28 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r1 = socket$unix(0x1, 0x0, 0x0) connect$unix(r1, &(0x7f0000000240)=@file={0x0, './file0/file0\x00'}, 0x6e) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) [ 480.487735] device lo entered promiscuous mode [ 480.494911] device lo left promiscuous mode [ 480.500079] binder: 20614:20616 ioctl c018620b 20000040 returned -14 03:37:28 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0xfffffffffffffffe, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008472714b8000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r4 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r4) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:37:28 executing program 2: write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:37:28 executing program 5: perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$selinux_avc_hash_stats(0xffffffffffffff9c, &(0x7f0000000000)='/selinux/avc/hash_stats\x00', 0x0, 0x0) ioctl$TIOCLINUX7(r0, 0x541c, &(0x7f0000000040)={0x7, 0x7fffffff}) syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'lo\x00@\x00', 0x101}) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000180)={"6c6f00000000000000000000000200", 0x1001}) [ 480.543248] binder: 20617:20620 ioctl c018620b 20000040 returned -14 03:37:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a8", 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:28 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000000080)='/dev/binder#\x00', 0x0, 0x4) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000000c0)={{{@in6=@dev, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6}, 0x0, @in=@loopback}}, &(0x7f00000001c0)=0xe8) quotactl(0x4, &(0x7f0000000040)='./file0\x00', r1, &(0x7f0000000300)="dca3d52c90e174a54a8e21e1742bb10556684d1ce415122103bbaa6300241e2b19c06756fde46fc4ce8f89d9b945708b55ff9cc1fb6151a4929fd41447b0adcaeb79501f2c4f9b2603ff9140c6a8e58fe04b8377dc8ffea16e26051c4250140630b5d8838d9c3c4b9623e2d4f5a706cdf3817d7b520dd3f165dbb98ae27eed804f40") r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r2, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) ioctl$BINDER_SET_CONTEXT_MGR(r2, 0x40046207, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) sendfile(r2, r2, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$fiemap(r0, 0xc020660b, &(0x7f0000000480)={0x2, 0x100, 0x4, 0x1, 0x3, [{0x3, 0x4, 0x3, 0x0, 0x0, 0x2000}, {0x2, 0xc574, 0x3, 0x0, 0x0, 0x280}, {0x1, 0xfffffffffffffffa, 0x7, 0x0, 0x0, 0x400}]}) [ 480.624795] device lo entered promiscuous mode [ 480.647793] binder: 20635:20640 ioctl c018620b 20000040 returned -14 [ 480.655661] device lo left promiscuous mode [ 480.689197] binder: 20639:20644 ioctl c0306201 20000440 returned -14 [ 480.709471] binder: 20639:20647 ioctl c0306201 20000440 returned -14 [ 480.735948] IPVS: Creating netns size=2536 id=117 [ 480.977116] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 480.991438] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 481.050489] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 481.064673] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 481.123261] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 481.137817] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 481.152102] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 481.169440] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 481.837151] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 481.873377] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 481.880094] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 481.888569] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:37:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a8", 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:30 executing program 6: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(0xffffffffffffffff) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r1}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r3, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:37:30 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:37:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_GET_DAEMON(r1, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x21408044}, 0xc, &(0x7f0000000180)={&(0x7f00000000c0)={0xb8, r2, 0x600, 0x70bd27, 0x25dfdbfe, {}, [@IPVS_CMD_ATTR_DAEMON={0x28, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x7}, @IPVS_DAEMON_ATTR_STATE={0x8}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @mcast2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x7}, @IPVS_CMD_ATTR_DEST={0x34, 0x2, [@IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e23}, @IPVS_DEST_ATTR_ADDR_FAMILY={0x8, 0xb, 0xa}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e22}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x90000}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x8001}]}, @IPVS_CMD_ATTR_DAEMON={0xc, 0x3, [@IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x1541}]}, @IPVS_CMD_ATTR_SERVICE={0x18, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x10, 0x20}}, @IPVS_SVC_ATTR_PORT={0x8, 0x4, 0x4e23}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xfffffffffffffff9}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8001}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, [@IPVS_DEST_ATTR_ADDR_FAMILY={0x8}]}]}, 0xb8}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:37:30 executing program 5: r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000080)='/dev/snapshot\x00', 0x4000, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x2000001, &(0x7f0000000100)=0x1, 0x27bfe992e66f2bd1) 03:37:30 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000200)='/dev/null\x00', 0x301040, 0x0) epoll_wait(r4, &(0x7f0000000280)=[{}, {}, {}, {}, {}], 0x5, 0x80000001) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000000000008001b0000002000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r5) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:37:30 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = dup(0xffffffffffffffff) write$P9_RUNLINKAT(r0, &(0x7f0000000180)={0x7, 0x4d, 0x2}, 0x7) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x1000) read$FUSE(r1, &(0x7f00000030c0), 0x1000) read$FUSE(r1, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r1, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000d00000001000000000000000000000b400000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000b7001efcefdf0358543c4a9bd0e8725d7f4a70f3eeb0bb6b4cbe772989ed8e2790a932b1302acad7c53f76192eca40b166ebbb9264fea001127a454c98da4cf949730c"], 0x90) openat$selinux_avc_cache_threshold(0xffffffffffffff9c, &(0x7f0000000040)='/selinux/avc/cache_threshold\x00', 0x2, 0x0) 03:37:30 executing program 7: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) acct(&(0x7f0000000180)='./file0/file0\x00') read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x200}}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) r1 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0x0) keyctl$clear(0x7, r1) signalfd4(r0, &(0x7f0000000040)={0x7fffffff}, 0x8, 0x80800) 03:37:30 executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:37:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a8", 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x10, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) [ 482.958766] binder: 21028:21038 ioctl c018620b 20000040 returned -14 [ 482.977515] binder: 21029:21034 ioctl c0306201 20000440 returned -14 03:37:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) llistxattr(&(0x7f0000000080)='./file0\x00', &(0x7f0000000480)=""/4096, 0x1000) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) ioctl$ASHMEM_SET_NAME(r1, 0x41007701, &(0x7f0000000040)='wlan0selinux/$ppp0\x00') 03:37:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a8", 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x10, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a8", 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x10, r1, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:30 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) ioctl$TCFLSH(r1, 0x540b, 0x5) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:37:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a8", 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) [ 483.091936] binder: 21053:21058 ioctl c0306201 20000440 returned -14 [ 483.100450] binder: 21053:21063 ioctl c0306201 20000440 returned -14 03:37:31 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:37:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a8", 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) [ 483.208905] binder: 21069:21071 ioctl c0306201 20000440 returned -14 [ 483.220776] binder: 21069:21079 ioctl c0306201 20000440 returned -14 [ 485.989221] IPVS: Creating netns size=2536 id=118 [ 486.022472] IPVS: Creating netns size=2536 id=119 [ 486.747162] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 486.766217] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 486.793706] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bridge: link is not ready [ 486.811926] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bridge: link is not ready [ 486.882547] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 486.906337] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 486.945226] IPv6: ADDRCONF(NETDEV_UP): veth0_to_bond: link is not ready [ 486.963661] IPv6: ADDRCONF(NETDEV_UP): veth1_to_bond: link is not ready [ 486.992312] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 487.012317] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 487.031368] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 487.050467] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 487.060769] IPv6: ADDRCONF(NETDEV_UP): veth0_to_team: link is not ready [ 487.079403] IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready [ 487.099005] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 487.131767] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 488.144359] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 488.199405] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 488.205555] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 488.213158] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 488.221034] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 488.275530] IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready [ 488.281752] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 488.289083] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready 03:37:37 executing program 6: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f00003b9fdc)) clock_gettime(0x0, &(0x7f0000000200)={0x0, 0x0}) ppoll(&(0x7f00000001c0)=[{r0}], 0x1, &(0x7f0000000240)={0x0, r1+10000000}, &(0x7f0000000280), 0x8) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000080)=0x80000000) r2 = syz_open_pts(r0, 0x0) ioctl$TCXONC(r2, 0x540a, 0x0) 03:37:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a8", 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(r0, 0xc018620b, &(0x7f0000000040)) 03:37:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r1, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r1, 0x0) sendfile(r1, r1, &(0x7f0000317000), 0xff8) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000000040)=0x0) sched_getaffinity(r2, 0x8, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:37:37 executing program 3: r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x1, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) r5 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) ioctl$BLKIOMIN(r4, 0x1278, &(0x7f0000000200)) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000440)=ANY=[@ANYBLOB="030e004078a37048d9fabdbe2b6667e313000000150008001b0000000000"], 0x1}}, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) syncfs(r0) ioctl$TIOCGPGRP(r5, 0x540f, &(0x7f0000000340)) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000000480)={0x0, @multicast1, @remote}, &(0x7f00000004c0)=0xc) getsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000000380)={0x0}, &(0x7f0000000400)=0xc) ioctl$TIOCGPGRP(r5, 0x540f, &(0x7f0000000500)) r8 = syz_open_procfs(r7, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r8) getsockopt$sock_cred(r8, 0x1, 0x11, &(0x7f0000000280)={0x0}, &(0x7f00000002c0)=0xc) fcntl$lock(r8, 0x7, &(0x7f0000000300)={0x3, 0x0, 0x0, 0x9000000000000000, r9}) memfd_create(&(0x7f0000000180)='[$[\x00', 0x1) rt_sigprocmask(0x0, &(0x7f0000000540)={0x1}, &(0x7f0000000580), 0x8) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:37:37 executing program 7: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) acct(&(0x7f0000000180)='./file0/file0\x00') read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x200}}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) r1 = add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0x0) keyctl$clear(0x7, r1) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) 03:37:37 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) r1 = open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) r2 = openat$keychord(0xffffffffffffff9c, &(0x7f0000000240)='/dev/keychord\x00', 0xa8000, 0x0) ioctl$RTC_WIE_OFF(r2, 0x7010) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246557656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000017002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000e1e91d6a998ca150b33a6074327954c85e975a337f3c997d035c5bffdaf395ce71ee2dcec03eeed1a8bb11c3459039b048157d1a8ffc32559a42cd8223066da8106a010f0fa8a442a6210e2d658869a98ae3312ccfafcb477ad038eded5b2acc8148e2d52bd29c18f3586cf3b0e2a555c0d385bb954853aed63b6c137ba38a1b2b9ceb1aa15ba48f8516bc8ce40757533a817873a6453972b67814f7fa7bab10c98adb8dc000000000000000"], 0x90) getsockname$inet6(r1, &(0x7f0000000040)={0xa, 0x0, 0x0, @remote}, &(0x7f0000000180)=0x1c) 03:37:37 executing program 5: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x0, &(0x7f00000008c0)={'trans=rdma,', {'port', 0x3d, 0x4e23}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:37:37 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) 03:37:37 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r0, &(0x7f0000000000)="a8", 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040)) 03:37:37 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r0, &(0x7f0000000000)="a8", 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040)) 03:37:37 executing program 4: mkdir(&(0x7f0000000040)='./file0\x00', 0xe) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f00000000c0)='fuse\x00', 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6f746d6f64653d303030303030303c30303030303030303030af9667069efc88c734303030302c", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x8, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x2}}, 0x24f) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) [ 489.544280] binder: 21834:21840 ioctl c0306201 20000440 returned -14 03:37:37 executing program 2: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0x0, 0x800) write(0xffffffffffffffff, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, 0xffffffffffffffff, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:37:37 executing program 1: syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r0 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r0, &(0x7f0000000000)="a8", 0x1) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r0, 0x0) ioctl$BINDER_GET_NODE_DEBUG_INFO(0xffffffffffffffff, 0xc018620b, &(0x7f0000000040)) 03:37:37 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000040)={0x0, 0x0, 0x0}, &(0x7f0000000180)=0xc) mount$fuse(0x0, &(0x7f0000000240)='./file0/file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000680)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id', 0x3d, r1}, 0x2c, {[{@blksize={'blksize', 0x3d, 0x1200}}, {@allow_other='allow_other'}]}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) 03:37:37 executing program 2: r0 = accept4$packet(0xffffffffffffff9c, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000080)=0x14, 0x800) write(r0, &(0x7f00000000c0)="74773cd4e6732515a7d779566210ab48f5b93df03b448b8f5a64fba5d084b9ed63580c9c58b53f3fb8096ee0803d", 0x2e) r1 = syz_open_dev$binder(&(0x7f0000d59ff3)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r2 = memfd_create(&(0x7f0000000280)="2d42d54e49c56aba707070f00884a26d003a2900bb8dacac76617d6b6e6823cb290fc8c03a9c631064eea98b4363ad899c6bdec5e936dd55a93dcd4a78aa8f7eb93061a9b2044b98933f8851f7d61da1ce8b19eaefe3abb6a52434d6fe370fe7d924ce20ab4eaec9bdd36740e127730e90f2cd72b828", 0x0) write(r2, &(0x7f0000000000)="a85883156f794c05e0b0", 0xa) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x4, 0x11, r2, 0x0) sendfile(r2, r2, &(0x7f0000317000), 0xff8) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300), 0x0, 0x0, &(0x7f00000003c0)}) 03:37:37 executing program 1: 03:37:37 executing program 6: 03:37:37 executing program 7: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) open(&(0x7f0000000000)='./file0/file0\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f00000030c0), 0x1000) acct(&(0x7f0000000180)='./file0/file0\x00') read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x0, 0x0, 0x0, 0x200}}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) add_key$keyring(&(0x7f0000000240)='keyring\x00', &(0x7f0000000280)={0x73, 0x79, 0x7a, 0x2}, 0x0, 0x0, 0x0) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) 03:37:37 executing program 1: 03:37:37 executing program 4: mkdir(&(0x7f00000001c0)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000400)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}}) r1 = open(&(0x7f0000000300)='./file0/file0\x00', 0x0, 0x128) read$FUSE(r0, &(0x7f00000030c0), 0x1000) symlinkat(&(0x7f0000000040)='./file0/file0\x00', r1, &(0x7f0000000180)='./file0/file0\x00') read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1, {0x7, 0x1b, 0x7, 0xfffffffffffffffe}}, 0x50) stat(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000480)) write$FUSE_DIRENT(r0, &(0x7f0000000500)=ANY=[@ANYBLOB="9000000000000000020000000000000001000000000000000000000b000000000066ce656d316e6f246576656d310000000000000000000000000000002c000000000000619fcd3823b7c94f5a3276ce8c9461000000000000001c000000000000002b7379737465746a48be1b31486dcc6370757365746367726f7570246367726f0004000000000000000000000000"], 0x90) 03:37:37 executing program 3: openat$autofs(0xffffffffffffff9c, &(0x7f0000000200)='/dev/autofs\x00', 0x20000, 0x0) r0 = syz_open_dev$loop(&(0x7f00000000c0)='/dev/loop#\x00', 0x4, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000100)='/dev/loop#\x00', 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/net/tun\x00', 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000240)={"766574000dcf2c0000001200bd6800", 0x43732e5398416f16}) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f00000000c0)='/selinux/enforce\x00', 0x8000, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f00000003c0)='/dev/hwrng\x00', 0x8000, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f0000000180)=ANY=[@ANYBLOB="030000000800000008001b0000000000"], 0x1}}, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/udp\x00') ioctl$LOOP_SET_FD(r0, 0x4c00, r5) ioctl$TIOCMGET(r4, 0x5415, &(0x7f0000000280)) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) 03:37:37 executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/fuse\x00', 0x2, 0x0) r1 = perf_event_open(&(0x7f00000004c0)={0x2, 0x70, 0x72, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000000100)}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f00000000c0)=0x9) setsockopt$packet_buf(0xffffffffffffffff, 0x107, 0x7, &(0x7f0000000140)="db1050", 0x3) perf_event_open(&(0x7f0000000040)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x50d}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) getxattr(&(0x7f0000000280)='./file0\x00', &(0x7f0000000340)=@known='security.capability\x00', &(0x7f0000000380)=""/88, 0x58) fchown(0xffffffffffffffff, 0x0, 0x0) lstat(&(0x7f00000007c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0}) close(r1) mount$9p_rdma(&(0x7f0000000540)='127.0.0.1\x00', &(0x7f0000000740)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000580)='9p\x00', 0x100004, &(0x7f00000008c0)={'trans=rdma,', {'port'}, 0x2c, {[{@timeout={'timeout', 0x3d, 0x1}}, {@common=@cache_loose='cache=loose'}, {@sq={'sq', 0x3d, 0xffffffff86abde1d}}, {@common=@dfltuid={'dfltuid', 0x3d, r2}}, {@sq={'sq'}}, {@rq={'rq', 0x3d, 0x8}}, {@timeout={'timeout', 0x3d, 0x2f}}, {@common=@debug={'debug', 0x3d, 0xfac1}}]}}) mkdir(&(0x7f00000009c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mount(&(0x7f0000000a80)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000a40)='./file0\x00', &(0x7f000015bffc)='nfs\x00', 0x7a00, &(0x7f0000000580)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={&(0x7f0000000000), 0xc, &(0x7f0000000140)={&(0x7f0000000b00)=ANY=[@ANYBLOB="d1c9db6cbcfe05f33d0b2e2a01f74ea07ec7c3ec590e8c5100000000000000000094bc989f070d45908a7c770e6cfcf61195e35df5ce466b79ce32099d62b6950cf0043523fb8ca8e7598613e28a6ce0b4b0579440a79a2b35f1b0b770960f00806cba583341c11886d909b07e3100659d3a12e9527bb1c915c9347e4f4e8dcfb5d7"], 0x1}}, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f00000002c0)='./file0\x00') mkdir(&(0x7f00000002c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) rename(&(0x7f00000001c0)="131377c5fc35d41454d5d41d29ad1a6029598146e6be166e41ad0dbd4054033c9f33bbda8224a2f3d772e7636e48b33cbf708372e8f1b9933ec5127743be2206209ef02df9cbf2f6e880d3382f00", &(0x7f0000000040)='./file0\x00') mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000300)='fuse\x00', 0x0, &(0x7f0000000640)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@default_permissions='default_permissions'}]}}) read$FUSE(r0, &(0x7f0000001000), 0x1000) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, 0x1}, 0x50) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000400)='/dev/zero\x00', 0x1050c1, 0x0) accept4$inet6(r4, &(0x7f0000000440)={0xa, 0x0, 0x0, @ipv4={[], [], @multicast2}}, &(0x7f0000000700)=0x1c, 0x800) stat(&(0x7f0000000480)='./file0\x00', &(0x7f00000005c0)) read$FUSE(r0, &(0x7f0000001000), 0x1000) [ 489.785257] binder: 21872:21876 ioctl c0306201 20000440 returned -14 [ 490.011714] [ 490.013519] ================================================