2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 342.701755][T25477] RSP: 002b:00007f3352107c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 342.748750][T25477] RAX: ffffffffffffffda RBX: 00007f3352107c90 RCX: 0000000000457e29 [ 342.748760][T25477] RDX: 00000000200000c0 RSI: 0000000020000040 RDI: 0000000000400000 [ 342.748770][T25477] RBP: 000000000073bf00 R08: 00000000200002c0 R09: 0000000000000000 12:45:51 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x60, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:45:51 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x80000) [ 342.748779][T25477] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f33521086d4 [ 342.748789][T25477] R13: 00000000004c3c72 R14: 00000000004d6ef0 R15: 0000000000000003 [ 342.763174][T25477] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:45:51 executing program 5 (fault-call:3 fault-nth:5): mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 342.996330][T25644] FAULT_INJECTION: forcing a failure. [ 342.996330][T25644] name failslab, interval 1, probability 0, space 0, times 0 [ 343.009588][T25644] CPU: 1 PID: 25644 Comm: syz-executor.5 Not tainted 5.0.0-rc8-next-20190301 #1 [ 343.018612][T25644] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 343.028661][T25644] Call Trace: [ 343.031983][T25644] dump_stack+0x172/0x1f0 [ 343.036329][T25644] should_fail.cold+0xa/0x15 [ 343.040947][T25644] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 343.046796][T25644] ? ___might_sleep+0x163/0x280 [ 343.051668][T25644] __should_failslab+0x121/0x190 [ 343.051698][T25644] should_failslab+0x9/0x14 [ 343.051716][T25644] kmem_cache_alloc_trace+0x2d1/0x760 [ 343.051804][T25644] alloc_fs_context+0x5a/0x640 [ 343.051859][T25644] fs_context_for_mount+0x25/0x30 [ 343.061310][T25644] do_mount+0x13d7/0x2c40 [ 343.061333][T25644] ? copy_mount_string+0x40/0x40 [ 343.061358][T25644] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 343.061371][T25644] ? copy_mount_options+0x280/0x3a0 [ 343.061389][T25644] ksys_mount+0xdb/0x150 [ 343.061406][T25644] __x64_sys_mount+0xbe/0x150 [ 343.061426][T25644] do_syscall_64+0x103/0x610 [ 343.061446][T25644] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 343.116559][T25644] RIP: 0033:0x457e29 [ 343.116573][T25644] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 12:45:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:45:52 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) socket$nl_xfrm(0x10, 0x3, 0x6) dup3(0xffffffffffffffff, r1, 0x80000) [ 343.116580][T25644] RSP: 002b:00007f3352107c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 343.116593][T25644] RAX: ffffffffffffffda RBX: 00007f3352107c90 RCX: 0000000000457e29 [ 343.116607][T25644] RDX: 00000000200000c0 RSI: 0000000020000040 RDI: 0000000000400000 [ 343.140103][T25644] RBP: 000000000073bf00 R08: 00000000200002c0 R09: 0000000000000000 [ 343.140112][T25644] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f33521086d4 [ 343.140121][T25644] R13: 00000000004c3c72 R14: 00000000004d6ef0 R15: 0000000000000003 [ 343.217986][T25707] binder: 25705:25707 ERROR: BC_REGISTER_LOOPER called without request 12:45:52 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:45:52 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xf0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:45:52 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) creat(&(0x7f0000000000)='./file0\x00', 0x80) 12:45:52 executing program 5 (fault-call:3 fault-nth:6): mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:45:52 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) socket$nl_xfrm(0x10, 0x3, 0x6) dup3(0xffffffffffffffff, r1, 0x80000) [ 343.419629][T25714] FAULT_INJECTION: forcing a failure. [ 343.419629][T25714] name failslab, interval 1, probability 0, space 0, times 0 [ 343.449365][T25714] CPU: 0 PID: 25714 Comm: syz-executor.5 Not tainted 5.0.0-rc8-next-20190301 #1 [ 343.458409][T25714] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 343.468469][T25714] Call Trace: [ 343.471801][T25714] dump_stack+0x172/0x1f0 [ 343.476164][T25714] should_fail.cold+0xa/0x15 [ 343.480765][T25714] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 343.486576][T25714] ? ___might_sleep+0x163/0x280 [ 343.491436][T25714] __should_failslab+0x121/0x190 [ 343.496383][T25714] should_failslab+0x9/0x14 [ 343.500911][T25714] kmem_cache_alloc_trace+0x2d1/0x760 [ 343.506283][T25714] ? refcount_dec_and_mutex_lock+0x90/0x90 [ 343.512091][T25714] ? rcu_read_lock_sched_held+0x110/0x130 [ 343.517818][T25714] ? kmem_cache_alloc_trace+0x354/0x760 [ 343.523389][T25714] legacy_init_fs_context+0x48/0xe0 [ 343.523405][T25714] ? generic_parse_monolithic+0x200/0x200 [ 343.523419][T25714] alloc_fs_context+0x365/0x640 [ 343.523439][T25714] fs_context_for_mount+0x25/0x30 [ 343.523455][T25714] do_mount+0x13d7/0x2c40 [ 343.523479][T25714] ? copy_mount_string+0x40/0x40 [ 343.523494][T25714] ? _copy_from_user+0xdd/0x150 [ 343.523520][T25714] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 343.539261][T25714] ? copy_mount_options+0x280/0x3a0 [ 343.539295][T25714] ksys_mount+0xdb/0x150 [ 343.539311][T25714] __x64_sys_mount+0xbe/0x150 [ 343.539347][T25714] do_syscall_64+0x103/0x610 [ 343.583370][T25714] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 343.589264][T25714] RIP: 0033:0x457e29 [ 343.593161][T25714] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 12:45:52 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x2ef, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:45:52 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) socket$nl_xfrm(0x10, 0x3, 0x6) dup3(0xffffffffffffffff, r1, 0x80000) [ 343.612779][T25714] RSP: 002b:00007f3352107c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 343.621193][T25714] RAX: ffffffffffffffda RBX: 00007f3352107c90 RCX: 0000000000457e29 [ 343.629186][T25714] RDX: 00000000200000c0 RSI: 0000000020000040 RDI: 0000000000400000 [ 343.637185][T25714] RBP: 000000000073bf00 R08: 00000000200002c0 R09: 0000000000000000 [ 343.645152][T25714] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f33521086d4 [ 343.653120][T25714] R13: 00000000004c3c72 R14: 00000000004d6ef0 R15: 0000000000000003 12:45:52 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = open(&(0x7f0000000000)='./file0\x00', 0x2, 0x8) ioctl$VIDIOC_S_FMT(r1, 0xc0d05605, &(0x7f00000000c0)={0xf, @pix_mp={0x3, 0x5, 0x0, 0x1, 0x3, [{0x9, 0x100}, {0x1, 0x7ff}, {0x1, 0x6}, {0x80000000, 0x10000}, {0x8, 0x7}, {0xfd2, 0x48000}, {0x4, 0x10001}, {0x3, 0x100000000}], 0x1, 0xffffffffffffff80, 0x6, 0x1, 0x1}}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$DRM_IOCTL_GET_MAP(r1, 0xc0286404, &(0x7f0000000040)={0x0, 0x80000001, 0x1, 0x40, &(0x7f000029e000/0x4000)=nil}) clone(0x0, 0x0, 0x0, 0x0, 0x0) 12:45:52 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xa00, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:45:52 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, 0xffffffffffffffff, 0x80000) 12:45:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:45:53 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xe00, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 344.056688][T25949] binder: 25947:25949 ERROR: BC_REGISTER_LOOPER called without request 12:45:53 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, 0x0) 12:45:53 executing program 5 (fault-call:3 fault-nth:7): mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:45:53 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, 0xffffffffffffffff, 0x80000) 12:45:53 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) 12:45:53 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xec0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 344.321571][T25958] FAULT_INJECTION: forcing a failure. [ 344.321571][T25958] name failslab, interval 1, probability 0, space 0, times 0 [ 344.344045][T25958] CPU: 0 PID: 25958 Comm: syz-executor.5 Not tainted 5.0.0-rc8-next-20190301 #1 [ 344.353070][T25958] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 344.363136][T25958] Call Trace: [ 344.366436][T25958] dump_stack+0x172/0x1f0 12:45:53 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, 0xffffffffffffffff, 0x80000) [ 344.370785][T25958] should_fail.cold+0xa/0x15 [ 344.375390][T25958] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 344.375413][T25958] ? ___might_sleep+0x163/0x280 [ 344.375434][T25958] __should_failslab+0x121/0x190 [ 344.391033][T25958] should_failslab+0x9/0x14 [ 344.395562][T25958] __kmalloc_track_caller+0x2d8/0x740 [ 344.395584][T25958] ? vfs_parse_fs_string+0xe8/0x170 [ 344.395605][T25958] kmemdup_nul+0x31/0xa0 [ 344.395621][T25958] vfs_parse_fs_string+0xe8/0x170 [ 344.395645][T25958] ? vfs_parse_fs_param+0x510/0x510 [ 344.420607][T25958] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 344.426847][T25958] ? alloc_fs_context+0x3bb/0x640 [ 344.431911][T25958] do_mount+0x6e9/0x2c40 [ 344.436167][T25958] ? copy_mount_string+0x40/0x40 [ 344.441136][T25958] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 344.447374][T25958] ? copy_mount_options+0x280/0x3a0 [ 344.452575][T25958] ksys_mount+0xdb/0x150 [ 344.456830][T25958] __x64_sys_mount+0xbe/0x150 [ 344.461523][T25958] do_syscall_64+0x103/0x610 [ 344.466124][T25958] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 344.472045][T25958] RIP: 0033:0x457e29 [ 344.472061][T25958] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 344.472069][T25958] RSP: 002b:00007f3352107c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 344.472084][T25958] RAX: ffffffffffffffda RBX: 00007f3352107c90 RCX: 0000000000457e29 [ 344.472093][T25958] RDX: 00000000200000c0 RSI: 0000000020000040 RDI: 0000000000400000 12:45:53 executing program 5 (fault-call:3 fault-nth:8): mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:45:53 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xf00, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 344.472117][T25958] RBP: 000000000073bf00 R08: 00000000200002c0 R09: 0000000000000000 [ 344.472126][T25958] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f33521086d4 [ 344.472150][T25958] R13: 00000000004c3c72 R14: 00000000004d6ef0 R15: 0000000000000003 12:45:53 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x6000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:45:53 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000100)='/dev/hwrng\x00', 0x40, 0x0) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000140)={'veth1_to_team\x00', 0x20}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = fcntl$dupfd(r2, 0x406, r0) ioctl$TIOCSWINSZ(r3, 0x5414, &(0x7f00000000c0)={0x7, 0xb078, 0xfffffffffffff59e, 0x6}) ioctl$KVM_GET_PIT(r2, 0xc048ae65, &(0x7f0000000000)) clone(0x0, 0x0, 0x0, 0x0, 0x0) [ 344.653476][T26077] FAULT_INJECTION: forcing a failure. [ 344.653476][T26077] name failslab, interval 1, probability 0, space 0, times 0 [ 344.684101][T26077] CPU: 1 PID: 26077 Comm: syz-executor.5 Not tainted 5.0.0-rc8-next-20190301 #1 [ 344.693129][T26077] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 344.703215][T26077] Call Trace: [ 344.706511][T26077] dump_stack+0x172/0x1f0 [ 344.710853][T26077] should_fail.cold+0xa/0x15 [ 344.715452][T26077] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 344.721271][T26077] ? ___might_sleep+0x163/0x280 [ 344.726155][T26077] __should_failslab+0x121/0x190 [ 344.731129][T26077] should_failslab+0x9/0x14 [ 344.735645][T26077] kmem_cache_alloc_trace+0x2d1/0x760 [ 344.741044][T26077] ? kasan_check_write+0x14/0x20 [ 344.745991][T26077] ? lock_downgrade+0x880/0x880 [ 344.750852][T26077] alloc_super+0x55/0x890 [ 344.755187][T26077] ? kasan_check_read+0x11/0x20 [ 344.760058][T26077] sget_userns+0xf1/0x560 [ 344.764390][T26077] ? get_anon_bdev+0xc0/0xc0 [ 344.768991][T26077] ? get_anon_bdev+0xc0/0xc0 [ 344.773590][T26077] sget+0x10c/0x150 [ 344.777650][T26077] ? ovl_show_options+0x550/0x550 [ 344.782733][T26077] mount_nodev+0x31/0x110 [ 344.787069][T26077] ovl_mount+0x2d/0x40 [ 344.791139][T26077] ? ovl_own_xattr_set+0x10/0x10 [ 344.796074][T26077] legacy_get_tree+0xf2/0x200 [ 344.800761][T26077] vfs_get_tree+0x123/0x450 [ 344.805271][T26077] do_mount+0x1436/0x2c40 [ 344.809917][T26077] ? copy_mount_string+0x40/0x40 [ 344.814859][T26077] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 344.814873][T26077] ? copy_mount_options+0x280/0x3a0 [ 344.814892][T26077] ksys_mount+0xdb/0x150 [ 344.814909][T26077] __x64_sys_mount+0xbe/0x150 [ 344.814929][T26077] do_syscall_64+0x103/0x610 [ 344.814953][T26077] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 344.826353][T26077] RIP: 0033:0x457e29 [ 344.826369][T26077] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 344.826378][T26077] RSP: 002b:00007f3352107c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 344.826393][T26077] RAX: ffffffffffffffda RBX: 00007f3352107c90 RCX: 0000000000457e29 [ 344.826402][T26077] RDX: 00000000200000c0 RSI: 0000000020000040 RDI: 0000000000400000 [ 344.826411][T26077] RBP: 000000000073bf00 R08: 00000000200002c0 R09: 0000000000000000 12:45:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:45:53 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) [ 344.826420][T26077] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f33521086d4 [ 344.826429][T26077] R13: 00000000004c3c72 R14: 00000000004d6ef0 R15: 0000000000000003 [ 344.959099][T26189] binder: 26186:26189 ERROR: BC_REGISTER_LOOPER called without request 12:45:54 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, 0x0) 12:45:54 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xc00e, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:45:54 executing program 5 (fault-call:3 fault-nth:9): mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:45:54 executing program 3 (fault-call:5 fault-nth:0): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) 12:45:54 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) timer_create(0x0, &(0x7f0000000200)={0x0, 0x12, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000140)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) r1 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x1, 0x41) write$binfmt_misc(r1, &(0x7f00000008c0)=ANY=[@ANYBLOB='c'], 0x1) ioctl$int_in(r1, 0x80000000005001, 0x0) r2 = gettid() tkill(r2, 0x1000000000016) clone(0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$IP_VS_SO_SET_TIMEOUT(r1, 0x0, 0x48a, &(0x7f0000000000)={0x400, 0x7, 0x8}, 0xc) [ 345.180896][T26200] FAULT_INJECTION: forcing a failure. [ 345.180896][T26200] name failslab, interval 1, probability 0, space 0, times 0 [ 345.204484][T26200] CPU: 0 PID: 26200 Comm: syz-executor.5 Not tainted 5.0.0-rc8-next-20190301 #1 [ 345.213515][T26200] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 345.223560][T26200] Call Trace: [ 345.223641][T26200] dump_stack+0x172/0x1f0 [ 345.223665][T26200] should_fail.cold+0xa/0x15 [ 345.223705][T26200] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 345.241666][T26200] ? ___might_sleep+0x163/0x280 [ 345.246537][T26200] __should_failslab+0x121/0x190 [ 345.246556][T26200] should_failslab+0x9/0x14 [ 345.246574][T26200] __kmalloc+0x2dc/0x740 [ 345.260223][T26200] ? __list_lru_init+0xd1/0x6e0 [ 345.260243][T26200] __list_lru_init+0xd1/0x6e0 [ 345.260265][T26200] alloc_super+0x762/0x890 [ 345.260287][T26200] sget_userns+0xf1/0x560 12:45:54 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) [ 345.260300][T26200] ? get_anon_bdev+0xc0/0xc0 [ 345.260318][T26200] ? get_anon_bdev+0xc0/0xc0 [ 345.260336][T26200] sget+0x10c/0x150 [ 345.291488][T26200] ? ovl_show_options+0x550/0x550 [ 345.296518][T26200] mount_nodev+0x31/0x110 [ 345.300857][T26200] ovl_mount+0x2d/0x40 [ 345.304941][T26200] ? ovl_own_xattr_set+0x10/0x10 [ 345.309879][T26200] legacy_get_tree+0xf2/0x200 [ 345.314567][T26200] vfs_get_tree+0x123/0x450 [ 345.319080][T26200] do_mount+0x1436/0x2c40 [ 345.323427][T26200] ? copy_mount_string+0x40/0x40 [ 345.328375][T26200] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 345.334616][T26200] ? copy_mount_options+0x280/0x3a0 [ 345.339821][T26200] ksys_mount+0xdb/0x150 [ 345.344084][T26200] __x64_sys_mount+0xbe/0x150 [ 345.348765][T26200] do_syscall_64+0x103/0x610 [ 345.353367][T26200] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 345.359255][T26200] RIP: 0033:0x457e29 12:45:54 executing program 5 (fault-call:3 fault-nth:10): mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:45:54 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, 0x0) 12:45:54 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xef02, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:45:54 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) r1 = syz_init_net_socket$ax25(0x3, 0x0, 0xcf) accept$ax25(r1, &(0x7f0000000000)={{0x3, @default}, [@bcast, @rose, @bcast, @bcast, @rose, @rose, @default]}, &(0x7f00000000c0)=0x48) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) [ 345.359271][T26200] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 345.359280][T26200] RSP: 002b:00007f3352107c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 345.359294][T26200] RAX: ffffffffffffffda RBX: 00007f3352107c90 RCX: 0000000000457e29 [ 345.359303][T26200] RDX: 00000000200000c0 RSI: 0000000020000040 RDI: 0000000000400000 [ 345.359313][T26200] RBP: 000000000073bf00 R08: 00000000200002c0 R09: 0000000000000000 [ 345.359328][T26200] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f33521086d4 [ 345.382815][T26200] R13: 00000000004c3c72 R14: 00000000004d6ef0 R15: 0000000000000003 [ 345.525815][T26316] FAULT_INJECTION: forcing a failure. [ 345.525815][T26316] name failslab, interval 1, probability 0, space 0, times 0 [ 345.557440][T26316] CPU: 1 PID: 26316 Comm: syz-executor.5 Not tainted 5.0.0-rc8-next-20190301 #1 [ 345.566459][T26316] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 345.566466][T26316] Call Trace: [ 345.566488][T26316] dump_stack+0x172/0x1f0 [ 345.566510][T26316] should_fail.cold+0xa/0x15 [ 345.566534][T26316] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 345.584203][T26316] ? ___might_sleep+0x163/0x280 [ 345.599456][T26316] __should_failslab+0x121/0x190 [ 345.604410][T26316] should_failslab+0x9/0x14 [ 345.608915][T26316] __kmalloc+0x2dc/0x740 [ 345.613177][T26316] ? __list_lru_init+0xd1/0x6e0 [ 345.618039][T26316] __list_lru_init+0xd1/0x6e0 [ 345.622723][T26316] alloc_super+0x762/0x890 [ 345.627148][T26316] sget_userns+0xf1/0x560 [ 345.631499][T26316] ? get_anon_bdev+0xc0/0xc0 [ 345.636090][T26316] ? get_anon_bdev+0xc0/0xc0 [ 345.640696][T26316] sget+0x10c/0x150 [ 345.644526][T26316] ? ovl_show_options+0x550/0x550 [ 345.649551][T26316] mount_nodev+0x31/0x110 [ 345.653897][T26316] ovl_mount+0x2d/0x40 [ 345.658001][T26316] ? ovl_own_xattr_set+0x10/0x10 [ 345.662947][T26316] legacy_get_tree+0xf2/0x200 [ 345.667645][T26316] vfs_get_tree+0x123/0x450 [ 345.672163][T26316] do_mount+0x1436/0x2c40 [ 345.676534][T26316] ? copy_mount_string+0x40/0x40 [ 345.681473][T26316] ? _copy_from_user+0xdd/0x150 [ 345.686329][T26316] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 345.692574][T26316] ? copy_mount_options+0x280/0x3a0 [ 345.697780][T26316] ksys_mount+0xdb/0x150 [ 345.702036][T26316] __x64_sys_mount+0xbe/0x150 [ 345.706732][T26316] do_syscall_64+0x103/0x610 [ 345.711330][T26316] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 345.717227][T26316] RIP: 0033:0x457e29 [ 345.721150][T26316] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 345.740750][T26316] RSP: 002b:00007f3352107c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 345.749157][T26316] RAX: ffffffffffffffda RBX: 00007f3352107c90 RCX: 0000000000457e29 [ 345.757127][T26316] RDX: 00000000200000c0 RSI: 0000000020000040 RDI: 0000000000400000 [ 345.757151][T26316] RBP: 000000000073bf00 R08: 00000000200002c0 R09: 0000000000000000 12:45:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:45:54 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x1000000) 12:45:54 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xf000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:45:54 executing program 5 (fault-call:3 fault-nth:11): mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 345.757160][T26316] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f33521086d4 [ 345.757170][T26316] R13: 00000000004c3c72 R14: 00000000004d6ef0 R15: 0000000000000003 12:45:54 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x6, 0x200401) r2 = syz_genetlink_get_family_id$SEG6(&(0x7f00000000c0)='SEG6\x00') sendmsg$SEG6_CMD_SETHMAC(r1, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="000a25bd7000ffdbdf250100000008001500d4000000c82cefe123e1ac6b61062cb81b6c0a3cf219c155fdcef511056d46c91c73c7d062f4028d04cebdeeaee371264db2a85fbe03a0cbdfa360578f7984b4cd130013b09412aca4738557297c938e71e1dabe84b378f8448bbd5968ee8c0a397a02e23808e2c34d4b890490b0b456daa88a2d9d27a0206edb9cae4f5fc11914bd08a3f1b3277c1a914cdf379c906a11fdd8832d7b83a92c82ce3d42ab47277226fec2ed49939860356f2a6c2aab89f690cb078c2f4eaf2a9b66927b7c314ce9938ea8e801a4eb1ecdf8ed59115d2ba084c960b0e86f1bba4fe181fafc7bde3b6f36b2334569c5f2264b0308d536d91e97b464033f74411258047eedaf75b9642fe0db584acb97db67a79c5165de82e485e6e16d9ad6289019e1474ea33ebb6bd88acff6c964e91bec6578e4bece69c78755"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40000) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) [ 345.894727][T26430] FAULT_INJECTION: forcing a failure. [ 345.894727][T26430] name failslab, interval 1, probability 0, space 0, times 0 12:45:54 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x100000000000000) [ 345.947382][T26439] binder: 26436:26439 ERROR: BC_REGISTER_LOOPER called without request [ 345.958331][T26430] CPU: 0 PID: 26430 Comm: syz-executor.5 Not tainted 5.0.0-rc8-next-20190301 #1 [ 345.967358][T26430] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 345.967364][T26430] Call Trace: [ 345.967388][T26430] dump_stack+0x172/0x1f0 [ 345.967411][T26430] should_fail.cold+0xa/0x15 [ 345.967432][T26430] ? fault_create_debugfs_attr+0x1e0/0x1e0 12:45:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) sync_file_range(r1, 0x8, 0x1, 0x4) r2 = syz_open_dev$radio(&(0x7f0000000000)='/dev/radio#\x00', 0x0, 0x2) ioctl$sock_inet_tcp_SIOCOUTQNSD(r2, 0x894b, &(0x7f0000000040)) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r3, r1, 0x0) [ 345.967455][T26430] ? ___might_sleep+0x163/0x280 [ 346.000312][T26430] __should_failslab+0x121/0x190 [ 346.000333][T26430] should_failslab+0x9/0x14 [ 346.000349][T26430] __kmalloc+0x2dc/0x740 [ 346.000369][T26430] ? __list_lru_init+0xd1/0x6e0 [ 346.000387][T26430] __list_lru_init+0xd1/0x6e0 [ 346.000408][T26430] alloc_super+0x762/0x890 [ 346.000428][T26430] sget_userns+0xf1/0x560 [ 346.000441][T26430] ? get_anon_bdev+0xc0/0xc0 [ 346.000461][T26430] ? get_anon_bdev+0xc0/0xc0 [ 346.041513][T26430] sget+0x10c/0x150 [ 346.045332][T26430] ? ovl_show_options+0x550/0x550 [ 346.050383][T26430] mount_nodev+0x31/0x110 [ 346.054740][T26430] ovl_mount+0x2d/0x40 [ 346.058814][T26430] ? ovl_own_xattr_set+0x10/0x10 [ 346.063770][T26430] legacy_get_tree+0xf2/0x200 [ 346.068452][T26430] vfs_get_tree+0x123/0x450 [ 346.072962][T26430] do_mount+0x1436/0x2c40 [ 346.077309][T26430] ? copy_mount_string+0x40/0x40 [ 346.082262][T26430] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 346.088504][T26430] ? copy_mount_options+0x280/0x3a0 [ 346.093726][T26430] ksys_mount+0xdb/0x150 [ 346.097983][T26430] __x64_sys_mount+0xbe/0x150 [ 346.102688][T26430] do_syscall_64+0x103/0x610 [ 346.107298][T26430] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 346.113199][T26430] RIP: 0033:0x457e29 [ 346.117111][T26430] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 346.136733][T26430] RSP: 002b:00007f3352107c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 12:45:55 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x34000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:45:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = dup3(r2, r1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000000)={@dev={0xfe, 0x80, [], 0xc}, 0x1, 0x2, 0xff, 0x1, 0x7134f071, 0x6}, 0x20) r4 = getpid() ioctl$RTC_SET_TIME(r3, 0x4024700a, &(0x7f00000015c0)={0x17, 0x17, 0xc, 0x1d, 0x1, 0x2, 0x6, 0x15a, 0xffffffffffffffff}) process_vm_readv(r4, &(0x7f0000000200)=[{&(0x7f0000000040)=""/62, 0x3e}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f0000000100)=""/124, 0x7c}, {&(0x7f0000000080)=""/54, 0x36}, {&(0x7f0000000180)=""/92, 0x5c}], 0x5, &(0x7f0000001540)=[{&(0x7f00000013c0)=""/81, 0x51}, {&(0x7f0000000280)=""/21, 0x15}, {&(0x7f0000001440)=""/44, 0x2c}, {&(0x7f0000001480)=""/81, 0x51}, {&(0x7f0000001500)=""/50, 0x32}], 0x5, 0x0) [ 346.136749][T26430] RAX: ffffffffffffffda RBX: 00007f3352107c90 RCX: 0000000000457e29 [ 346.136759][T26430] RDX: 00000000200000c0 RSI: 0000000020000040 RDI: 0000000000400000 [ 346.136769][T26430] RBP: 000000000073bf00 R08: 00000000200002c0 R09: 0000000000000000 [ 346.136778][T26430] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f33521086d4 [ 346.136788][T26430] R13: 00000000004c3c72 R14: 00000000004d6ef0 R15: 0000000000000003 [ 346.137084][ C0] net_ratelimit: 22 callbacks suppressed [ 346.137092][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 346.196763][ C0] protocol 88fb is buggy, dev hsr_slave_1 12:45:55 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x2000802, 0x200) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000040)={r1}) ioctl$SIOCRSGL2CALL(r2, 0x89e5, &(0x7f0000000080)=@default) r3 = syz_open_dev$vcsn(&(0x7f0000000000)='/dev/vcs#\x00', 0x6, 0x200000) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000100)={0x0, 0x9, 0x10}, &(0x7f0000000140)=0xc) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000180)={r4, 0x4, 0x20}, &(0x7f00000001c0)=0xc) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r5, r1, 0x0) 12:45:55 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x400300, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:45:55 executing program 5 (fault-call:3 fault-nth:12): mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 346.413023][T26564] FAULT_INJECTION: forcing a failure. [ 346.413023][T26564] name failslab, interval 1, probability 0, space 0, times 0 [ 346.438207][T26564] CPU: 0 PID: 26564 Comm: syz-executor.5 Not tainted 5.0.0-rc8-next-20190301 #1 [ 346.447233][T26564] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 346.457278][T26564] Call Trace: [ 346.460571][T26564] dump_stack+0x172/0x1f0 [ 346.464900][T26564] should_fail.cold+0xa/0x15 [ 346.469475][T26564] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 346.475264][T26564] ? ___might_sleep+0x163/0x280 [ 346.480103][T26564] __should_failslab+0x121/0x190 [ 346.485024][T26564] should_failslab+0x9/0x14 [ 346.489511][T26564] kmem_cache_alloc_trace+0x2d1/0x760 [ 346.494868][T26564] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 346.500666][T26564] __memcg_init_list_lru_node+0x8a/0x1e0 [ 346.506324][T26564] __list_lru_init+0x3cf/0x6e0 [ 346.511087][T26564] alloc_super+0x762/0x890 [ 346.515490][T26564] sget_userns+0xf1/0x560 [ 346.519797][T26564] ? get_anon_bdev+0xc0/0xc0 [ 346.524384][T26564] ? get_anon_bdev+0xc0/0xc0 [ 346.528977][T26564] sget+0x10c/0x150 [ 346.532823][T26564] ? ovl_show_options+0x550/0x550 [ 346.537825][T26564] mount_nodev+0x31/0x110 [ 346.542154][T26564] ovl_mount+0x2d/0x40 [ 346.546204][T26564] ? ovl_own_xattr_set+0x10/0x10 [ 346.551121][T26564] legacy_get_tree+0xf2/0x200 [ 346.555787][T26564] vfs_get_tree+0x123/0x450 [ 346.560299][T26564] do_mount+0x1436/0x2c40 [ 346.564611][T26564] ? copy_mount_string+0x40/0x40 [ 346.569529][T26564] ? _copy_from_user+0xdd/0x150 [ 346.574362][T26564] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 346.580578][T26564] ? copy_mount_options+0x280/0x3a0 [ 346.585770][T26564] ksys_mount+0xdb/0x150 [ 346.589994][T26564] __x64_sys_mount+0xbe/0x150 [ 346.594693][T26564] do_syscall_64+0x103/0x610 [ 346.599270][T26564] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 346.605162][T26564] RIP: 0033:0x457e29 [ 346.609050][T26564] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 346.628636][T26564] RSP: 002b:00007f3352107c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 346.637043][T26564] RAX: ffffffffffffffda RBX: 00007f3352107c90 RCX: 0000000000457e29 [ 346.644993][T26564] RDX: 00000000200000c0 RSI: 0000000020000040 RDI: 0000000000400000 [ 346.652955][T26564] RBP: 000000000073bf00 R08: 00000000200002c0 R09: 0000000000000000 [ 346.660916][T26564] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f33521086d4 [ 346.668875][T26564] R13: 00000000004c3c72 R14: 00000000004d6ef0 R15: 0000000000000003 [ 346.679843][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 346.685623][ C1] protocol 88fb is buggy, dev hsr_slave_1 12:45:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:45:55 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$midi(&(0x7f0000000000)='/dev/midi#\x00', 0xde, 0x400000) getsockopt$inet_sctp_SCTP_CONTEXT(0xffffffffffffff9c, 0x84, 0x11, &(0x7f0000000040)={0x0, 0x100}, &(0x7f00000000c0)=0x8) getsockopt$inet_sctp6_SCTP_CONTEXT(r1, 0x84, 0x11, &(0x7f0000000100)={r2, 0x4}, &(0x7f0000000140)=0x8) setsockopt$IP_VS_SO_SET_STARTDAEMON(r1, 0x0, 0x48b, &(0x7f00000001c0)={0x0, 'bcsf0\x00', 0x3}, 0x18) ioctl$TIOCOUTQ(r1, 0x5411, &(0x7f0000000180)) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$rxrpc(0x21, 0x2, 0xa) 12:45:55 executing program 2 (fault-call:6 fault-nth:0): r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:45:55 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xf0ffff, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:45:55 executing program 3: r0 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/btrfs-control\x00', 0x90880, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000040)="2e0000001a008100a00f80ecdb4cb9040a4865160b000000d4126efb12000300020a000040d819a9ffe200000000", 0x2e}], 0x1}, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r0, 0xc058534f, &(0x7f0000000140)={{0xecfb38d, 0x4}, 0x1, 0x2, 0x46e, {0x9, 0x2}, 0x5}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000200)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_SET(r0, &(0x7f0000000400)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000240)={0x5c, r3, 0x200, 0x70bd2a, 0x25dfdbfc, {}, [@TIPC_NLA_MON={0x3c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x67}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xffffffffffffffff}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xbb}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xffff}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x9}, @TIPC_NLA_MON_REF={0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}]}, @TIPC_NLA_SOCK={0xc, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x9}]}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40}, 0x0) ioctl(r2, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r4 = socket$inet6(0xa, 0x82000, 0x2c) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x6, &(0x7f0000000000)='ppp1(\x00', 0xffffffffffffffff}, 0x30) ioctl$DRM_IOCTL_AGP_ALLOC(r0, 0xc0206434, &(0x7f0000000440)={0xffffffffffff0001, 0x0, 0xf33c8e085a63981d, 0x9}) ioctl$DRM_IOCTL_AGP_FREE(r0, 0x40206435, &(0x7f0000000480)={0x6, r6, 0x2, 0x4}) fcntl$lock(r4, 0x25, &(0x7f0000000080)={0x1, 0x3, 0x1000000000, 0xffffffff, r5}) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r7, r4, 0x0) 12:45:55 executing program 5 (fault-call:3 fault-nth:13): mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 346.787951][T26572] netlink: 'syz-executor.3': attribute type 3 has an invalid length. [ 346.839091][T26605] netlink: 'syz-executor.3': attribute type 3 has an invalid length. [ 346.840931][T26582] FAULT_INJECTION: forcing a failure. [ 346.840931][T26582] name failslab, interval 1, probability 0, space 0, times 0 [ 346.847595][T26580] binder: 26578:26580 ERROR: BC_REGISTER_LOOPER called without request [ 346.860289][T26582] CPU: 1 PID: 26582 Comm: syz-executor.5 Not tainted 5.0.0-rc8-next-20190301 #1 [ 346.877137][T26582] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 346.887219][T26582] Call Trace: [ 346.890521][T26582] dump_stack+0x172/0x1f0 [ 346.894857][T26582] should_fail.cold+0xa/0x15 [ 346.899466][T26582] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 346.905297][T26582] ? ___might_sleep+0x163/0x280 [ 346.910184][T26582] __should_failslab+0x121/0x190 [ 346.915133][T26582] should_failslab+0x9/0x14 [ 346.919629][T26582] kmem_cache_alloc_trace+0x2d1/0x760 [ 346.924983][T26582] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 346.930798][T26582] __memcg_init_list_lru_node+0x8a/0x1e0 [ 346.936424][T26582] __list_lru_init+0x3cf/0x6e0 [ 346.941658][T26582] alloc_super+0x762/0x890 [ 346.946067][T26582] sget_userns+0xf1/0x560 [ 346.950387][T26582] ? get_anon_bdev+0xc0/0xc0 [ 346.954993][T26582] ? get_anon_bdev+0xc0/0xc0 [ 346.959571][T26582] sget+0x10c/0x150 [ 346.963370][T26582] ? ovl_show_options+0x550/0x550 [ 346.968375][T26582] mount_nodev+0x31/0x110 [ 346.972740][T26582] ovl_mount+0x2d/0x40 [ 346.976802][T26582] ? ovl_own_xattr_set+0x10/0x10 [ 346.981748][T26582] legacy_get_tree+0xf2/0x200 [ 346.986422][T26582] vfs_get_tree+0x123/0x450 [ 346.990934][T26582] do_mount+0x1436/0x2c40 [ 346.995271][T26582] ? copy_mount_string+0x40/0x40 [ 347.000218][T26582] ? _copy_from_user+0xdd/0x150 [ 347.005207][T26582] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 347.011443][T26582] ? copy_mount_options+0x280/0x3a0 [ 347.016637][T26582] ksys_mount+0xdb/0x150 [ 347.020896][T26582] __x64_sys_mount+0xbe/0x150 [ 347.025580][T26582] do_syscall_64+0x103/0x610 [ 347.030178][T26582] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 347.036082][T26582] RIP: 0033:0x457e29 [ 347.039964][T26582] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 347.059558][T26582] RSP: 002b:00007f3352107c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 347.067942][T26582] RAX: ffffffffffffffda RBX: 00007f3352107c90 RCX: 0000000000457e29 [ 347.075901][T26582] RDX: 00000000200000c0 RSI: 0000000020000040 RDI: 0000000000400000 12:45:56 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x1000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:45:56 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x50d2, &(0x7f00000003c0)="b06bd914389f7cc9e01d07cd00e476ab06f2b081aef257561315aa5a5126806daa361d2f113d04099c2d9318ade4f999f2b931afd725531a30b65738e4b39b773b3f5140ba1de8070b0faf18b3cf7decf8f0d578d1acc5794377b8f1a9c2fe8cac7be610947064c1910f47bde9167bcddb4f134118a002c727747139829f45273fc6d9bbd0ca1582d328923a9e048729048eb06c60c0208a7e13a83f97987bf4254c1400a7429e765ea740607ea1b1cf2218e4fc3f690dc86fa412a9ec7252ea9683107839aeb9df60642972b7a3cdcbe68134b0900744ecffac0273f2316db6cf1a9652783c785e5109fb065e16b15eec78279f59c12cb7a9dc56a0e2adf114179b80b063611b24b276405ac39ccd7f42808376f4430328bd00c3ebdee1c8c43580b10c1b3a21c3162b83ddc678eab2bb586e0ae2660eb756a177cc4e681b4e97595608364b1927b76434d637b088ceb0bb7a0c314ba38a6ee28b5a686513d34be5a44586ba0605ac0bf6aaa8010c0d16fff5088cd07e402d9900630f478f8269f37231e5e1fb31d7813fd4b97fd431758ad7815de637b101096272756ae6d0963956605a30dcc53ddd4e17b211081b76cbee1ab00bd9e5e5e15fce2cd7a9a7d5f3fd33e61c88cd1d69e8a2dd21542d3b258ea812861ade1c5bb9f4686a5c7759b1a5f0a7c3344af7094535fcb57ddd84fc83b5e6cb91abe6008c5fb0aa5d40d6cbe70ef3cee1a750dfa3e674d4a1b3f55393e3156837f8ffba9d8d06c32c28580cdeb290cea39e71177df12acdabfe1d521168b1e13ab38197ab23341296adc205f7f04ec58a1d9476a0f0d67fb2a59acf596e42d88364c25a197f1feb3538398acfb2abae1583a876af8c3fdf1119c6fc675237dd10191a576647d1286fb644342e064690d91a6dc0b2ad4708e0823b9aa24a5738fc2ce82fb9248854f71070c7ca919e45ed43c1b1221541f257dec06bb1270d20aa1f3cf5cff7dab19db5965cdb828b14cc6af42c9e48e4a8a584f6e93515d4e9e4af428ea26a41224994f414e05e722808ed07ae9657f8ef936105091e05b1c84db35e9f48dccd78a9a32a99fc2af88441f05226610a00627a8059bac727770197504b63898f58c6bf373606cccd92cf47985d292d5430d48f12a98cbd6fbad5baa34a738a6f2397847b19b4a589a42a408cbd7c9e0a3ae6708226eaa451b27b7d34f9ea17839ec793c9411b80bcd05efd35da02b4dc1ced6b78b9bd01c4f6afd7d2846b618d6d08a447997808828d59a027449e342dc0bbdb2a0fb33e116c554830bbe58d0015625678dc91a3d8957160b3911c06f0d41022a7cbebd3fcdc42d05c254c0c8a7b54c6a3c365b138e21325562b32a078f9e6beb4b58c6567520954fa04f58fae90742b0e77691b1af7cf1abc3082635be91553bf1ecb953d45aad90af669210cc2dec0299a5b6a78368d8d8a91acb7fbedd593206e18b4ad35d16a26d2b2f58de2a909507456eeae44ffcfb4ba330566b1adf4fa5cc4afde53acae63f4161d95be8d4be8c34e7d6432ef1fb2ac8fa88725a07508779c6a8b5436d5268c4adc4eb49826474d0ef898209322ce139cd08b573f7b891dd4ff96250856fcf07790bba04815c485987092929a4d48e9025d8b5b1807c29aaae0ba64c80d21bff0c1693f56689e2f07a38dd7f772dca75cd56380c808f1483500e6b118d5220daa9c25dc0a495c329b9d7faaf2c678d2d4d84c6a8c6d8c9f2ab8e816f32d40ae927a71a1689d03e8e493acf72c24c2bbb6a3d7b671f667a919b37253f3fc03ebeaa6ebb0e026c486e85d348333ed9abb187e62ff19bd81954c837899e0adc98061a491ac8b8b2a7d499b3fc1013b5e5371fbda36882d0039a96cc39728af11435c9d4788fa41e80e3c2322065b9ab5128b6d168552ee51f2e1542e2c7fa37e52f46b75ffce44a0a174c6620f9527274dee55dcb12f1880021536709ab7e46e319d2c28521776b28fe9a191656ca0b3261eccc090305abf5042072a684d3d97bb74718023df9320773f3484e4a454ca9e5dfafb4fb0d98f88d4585609552b6bc6bfe0732a1391490dc8f2d145ae4eaf25c287b812488202193360942e81c44be3336245540fd30705a8ad4642b71b72dee2bf3a2c7c93acb627f6ff01405de0a748b7b93a0de9d2f94df248e3b3a78d20f1da7afcd288f2af5ae53976538f12e6c7a3f9b6c6bc81e64684668cbf37d9fc21d99d786b3f40b6e3b1ee4816fc4054e31f8b4e6197a56a54c46493b2e4e093a7b8875ddcb95fb4a47968cce065901e339730f4467c89ad5d5a8abcba0a352a09ef594b93efb2b95521fb337abcf9da437b3786ba7f8dd7f1c37a70696b9ea23703ded54611d2763ec7f53e14d094ca43b48b4edc191e0dcea73a1a88ffe92763fc972199e70bbce1ca88bbb9cbe1157aacaf9376f8279d806d78e92c233f08964a38b3a69dae1e0c5e17d99bab3f27b67e2801280c089b89c5f22e7bc9ae4d41bfbd5e5bd16db2e563110e4fd9da62a04cff91951bc3b45ab5cdf7741c053c7cab378142ff3208fa33a361b9d6b438bd17b785452fba8d4dda8f2c3dcb61e7bf130e8624535cac9e2f9b5ab9ffe56b77927a06156e2825498fa91b6cd8b7f6f7bad6fc45c940bf1ec718578fb6d0ca3a92686783a0404811d8fc9bb97b20a99d969749b2c712d531d5f36b6a838b96ce9b9ce4d6bd6dfc5595e3fd6fd8106bd51db2bfb4bbb83744b45ba31f7baefb407e8cd9172f200e9a60ce50d8cae31f38593add3c2d0bff62fdd3babe0651de92d8fb666539897f8243da1ee2e119cf6a575ddeacf7fb3cd3f1072fce9a55dc35bf9d4f29582c97c09ec4837a4fd15df3770e585ce75d4aa2b42e406b138423bfc1e29cf27b48ace66a48b6631a77375d9b9bb06b24a3980db0be2323e0e3c41df0d64b128c0cfafbcb7852af68fc77c0752aff084748eeede10811f188af954904681d592b580559e57152752bdec82ab1bff79ac2254f1b4991e9784d80ffadb0f4e3e618c28eb166aaccfe1dd6c1a4b58f3bf0754f9b2d4b4f4f2bcc62e84d964d5d0633ae595a9761b3a24380ac706c140724177350ae43def9f9af2df38a616b145659260dfba8470e88ff0f55b4c7db689376e3c588022dafb669e917b7684e805ac6da685aecb98dc5f3305bceec238f5518f3dfa17d7754dbdbbc5c4ba1dd185e3aceec004d61719b6d3c8ce01395e361fccf6b5fb5dcd8540f1915117ec5ea717af52bf1ddcfb63f553ae81f56e27c84fd372a776f250182442ff2e40d2f12a892c12405869aea4663e9790e55a37ce8c1ab185912a514feef90b2f5e877520b10e3d2b4e00f84db9fd5f0540663c3efc7de3d686bf3c12b4f8e7e142a4355125d777f05e94006067d8afdabe53137e21820bcc155c863a2b35693d95c3ad46bab039c75bd778d1b8cb321fb5c1c71b063df4d88f5f21ab287aef73fea722a764c3cbde0575e4bd2b1a624ad605db1dd971944d414ffd7c458ca49e81c2f5f08d3bff59e849ee72ad71386ad4eb101486c9b0b3e4e5823115089fff76ad0fa4cc2154874847ae62deb469279fd6192d4167112a15bf180ec4a687c0a6cecac13810a69cc2d06b4a3372f516f4b5c02187d7a5728c5978dbc9133cdc01bbc47b60e7dba6e518e07e39b14994942ebdc09a3cf95150db568859b401e39aba4cdd415596cb71e961f64cf4c83290441d33a685a8686e2207b975fc394b137a3553f3873c4a8b02156dba387eb1ab0daaf7ab6f5842fc30c64e6e941a7ed813044c4ef131b873aa878cc9f2b1609035b421cb399f07e7ece6815ca22fd266379769d08683932fa4867469150d9a9ffe20ded9b9c58067241d79853b054d5a24444c99f25caab7ee0fef59b1a6fff77581fd4586fec41edd4c9b48cbf601dfaabb734f6c5f6a39f01fa6792fdfa6b0b71f511c013c38b527e74965aded1f3e511b8ebfa246dbae9697980fba01c44e6d47f23f747926cf9ddbc1d8c4ee6b9beccb6c8f3e6d544e2535c80eced02b9e4aa1260a9ed1e37e5a569e3a0f75f3b275b4a16d790cfe3767e51d6c2282032ce8f05c9a480b82193f7eb2e7ee55e02eeefb34e30944c63559860d1d248e2eb94b327527762eb34ceb2a49b0a956cf849c283413bdafb0acaae53c7cf6350fc91fd18056f086c2e2c4fa6675d5121ff81566753ff864ed18e03a908ebbb76048927693d7b46d1a425bb73b7d40f6403ed54f46a641aa1414778475422505b3906da275ce95be72073e283b24b2ef4cb394cc3cbd8f4e4aab87bef5667adbabc3a6c5c1b14434eeb95b9b482168a3ce4de35e8414e7ef31aea9d51253c7f8c315196ee50043ef881bac02ed24a4589397345dd53e2ece5170be107943012fc356bbf142264fe24239c0564ad0aece46c8adef7d575f162a3b2ccd3552932715d9cb92f6188ea312bd4f76b9b3e3f338c1f7ba287d30d4ce628489a225dcf54aa5ef00730c888bd11fae254f204a008fea7dc6a36d031d13cc2d5963fafa4deaee426cb2611d1f009c03334ef07ee9cfca05ed22d5edbbf8ac54cb376b4e17a25405490d0ad850c30f2099b09cc806caea8de67a1b140ef82c67c97163fbf2915de9cceaa60e84a654eab5f3096c93edd6a4b9f167005e322c8ebaf22de6238f7277c687764c97363782190ba7865d31e36b10a64834d754934fdff45d2ef333cc6eb2283dea684665cc135a4d690542f76955f8e75cfe97762b9b6c9edb9440192931a35c3cf2dd2ebd49593539130f6e123f30ae85aa2c324976df7aa0457f0de7ff0b8e8387db52227622d34fa25566f55a52a85f5a51b954e78673c5b8319619f9e99ce667a46c3e46626714489127615b9fb179dcd9f64576341df075aeda9b93c1323ee69b6e22cb836360edf06092e3da3b7e0b467871109f61727206b8ca62776ae17fd5381b07a315b12e36815f4a2c164fae862c952db6d51af6b0062d031de049d75bd346a17a2acabb873d761de0a855cf31414a1722f93e7c5cfdb82500e1fdd3410716f530d73ff62b94d8ecf67fdb39a0166222a7c75ef695c459fef86ab54f29b04a7b5d45437f32190bb56879d80e8ccdfa31658f432ca5a0a9ef249ea5def5d5ae66c02f8e1857e4d555ef22aa779e64edb2bfd410e4e6a633d3e074e3646387dd8198381e7e93525c6c13e36dc536852734d9eadc02c77ec5da5aa697d7760dcc321c3acc595f75f3ff38186b37e8528ca7896396d79f5d18b371dfa3bc169a5c9046e2dc473e4cba08fb10585921c83b582e268a76b7cbf398fc58de90c885ef2ad48364bb43fe62e2efb84fbfd259c1cd3d701b0bd42591d246b49220be3451e45e00d5aad12ddcc060110d5d93892cba9c7478b5a9d9aa388f0db7565b34748907a1d2fe4662eadb0afeade67f95c24e507eeee25a30ede5f7dec0ae38c0b012bf6fce19e123bac41a0c69ad7b8189cbef5947e4cd2be5f66b770e8e536773ed3ac21320f34a5a9b5624ecd7fb8480a094a6430d9acfbb5cdc3bc9e0bf208df95a462142c841b6da2c255c47f7a367d1dec72b523b0214849a0e5bb42af298817232f01f0a30d4cec1b7952f4da19928c0e7cf1c6278a7a75b650b486695abd5ecc2869645a18c59620789cffe50112c0ae7285b45164bc5977ea833bb444e6e3b6dd8efedbd1646315ba3304a1d6d659e9a3b96416df85c8fd62fe42c10a0242441b8bc2335713183b0917c16f3aa95f24e7674756cc19e029f07a8cbc654b01e0d5269163cbd7473fd08f") ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") write$binfmt_elf32(r0, &(0x7f00000013c0)={{0x7f, 0x45, 0x4c, 0x46, 0x3, 0x40, 0x1ff, 0xad49, 0x8, 0x3, 0x6, 0x2b4, 0x2e0, 0x38, 0x1d, 0x5, 0x7f8000, 0x20, 0x2, 0xfffffffffffffffc, 0x5, 0x2}, [{0x4, 0x3, 0xf0, 0x4, 0xfffffffffffffff8, 0x1, 0x1, 0x3}, {0x7474e551, 0x3, 0x4, 0x6, 0x200, 0x0, 0xff, 0x4}], "dd183be0739875f3567d819f3b51a95ac40dce067daf57f1d715b057bc1ce9e683b8b2cb24c67dd8", [[], [], [], [], [], [], [], [], []]}, 0x9a0) r1 = socket$inet6(0xa, 0x3, 0x100000001) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000)='/dev/autofs\x00', 0x2, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000100)={0x0, 0x8}, &(0x7f0000000140)=0x8) setsockopt$inet_sctp_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000180)={r3, 0xff, 0x80000000, 0x8, 0x10000, 0x2}, 0x14) ioctl$KVM_CHECK_EXTENSION(r2, 0xae03, 0x3ff) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r4, r1, 0x0) getsockopt$packet_buf(r2, 0x107, 0xf, &(0x7f00000001c0)=""/173, &(0x7f0000000040)=0xad) [ 347.083866][T26582] RBP: 000000000073bf00 R08: 00000000200002c0 R09: 0000000000000000 [ 347.091841][T26582] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f33521086d4 [ 347.099812][T26582] R13: 00000000004c3c72 R14: 00000000004d6ef0 R15: 0000000000000003 12:45:56 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:45:56 executing program 5 (fault-call:3 fault-nth:14): mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:45:56 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x2000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:45:56 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f0000000000)) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/audio\x00', 0x0, 0x0) setsockopt$TIPC_GROUP_LEAVE(r3, 0x10f, 0x88) dup3(r2, r1, 0x0) [ 347.239783][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 347.245596][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 347.308405][T26699] FAULT_INJECTION: forcing a failure. [ 347.308405][T26699] name failslab, interval 1, probability 0, space 0, times 0 [ 347.363710][T26699] CPU: 1 PID: 26699 Comm: syz-executor.5 Not tainted 5.0.0-rc8-next-20190301 #1 [ 347.372735][T26699] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 347.382795][T26699] Call Trace: [ 347.386095][T26699] dump_stack+0x172/0x1f0 [ 347.390437][T26699] should_fail.cold+0xa/0x15 [ 347.390457][T26699] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 347.390478][T26699] ? ___might_sleep+0x163/0x280 [ 347.390499][T26699] __should_failslab+0x121/0x190 [ 347.390518][T26699] should_failslab+0x9/0x14 [ 347.390533][T26699] kmem_cache_alloc_trace+0x2d1/0x760 [ 347.390550][T26699] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 347.390575][T26699] __memcg_init_list_lru_node+0x8a/0x1e0 [ 347.390593][T26699] __list_lru_init+0x3cf/0x6e0 [ 347.390614][T26699] alloc_super+0x762/0x890 [ 347.390634][T26699] sget_userns+0xf1/0x560 [ 347.390647][T26699] ? get_anon_bdev+0xc0/0xc0 [ 347.390663][T26699] ? get_anon_bdev+0xc0/0xc0 [ 347.390677][T26699] sget+0x10c/0x150 [ 347.390718][T26699] ? ovl_show_options+0x550/0x550 [ 347.390739][T26699] mount_nodev+0x31/0x110 [ 347.390757][T26699] ovl_mount+0x2d/0x40 [ 347.390771][T26699] ? ovl_own_xattr_set+0x10/0x10 [ 347.390785][T26699] legacy_get_tree+0xf2/0x200 [ 347.390803][T26699] vfs_get_tree+0x123/0x450 [ 347.390820][T26699] do_mount+0x1436/0x2c40 [ 347.390850][T26699] ? copy_mount_string+0x40/0x40 [ 347.390876][T26699] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 347.390889][T26699] ? copy_mount_options+0x280/0x3a0 [ 347.390910][T26699] ksys_mount+0xdb/0x150 [ 347.390927][T26699] __x64_sys_mount+0xbe/0x150 [ 347.390949][T26699] do_syscall_64+0x103/0x610 [ 347.390970][T26699] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 347.390983][T26699] RIP: 0033:0x457e29 [ 347.390998][T26699] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 347.391006][T26699] RSP: 002b:00007f3352107c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 347.391021][T26699] RAX: ffffffffffffffda RBX: 00007f3352107c90 RCX: 0000000000457e29 [ 347.391031][T26699] RDX: 00000000200000c0 RSI: 0000000020000040 RDI: 0000000000400000 [ 347.391041][T26699] RBP: 000000000073bf00 R08: 00000000200002c0 R09: 0000000000000000 [ 347.391050][T26699] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f33521086d4 [ 347.391059][T26699] R13: 00000000004c3c72 R14: 00000000004d6ef0 R15: 0000000000000003 [ 347.392408][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 347.392451][ C0] protocol 88fb is buggy, dev hsr_slave_1 12:45:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000500), 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:45:56 executing program 4: arch_prctl$ARCH_GET_FS(0x1003, &(0x7f0000000000)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0xc2030, 0xffffffffffffffff, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) 12:45:56 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x42002, 0x0) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffff9c, 0x84, 0x71, &(0x7f0000000040)={0x0, 0x7}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000100)={r2, 0x6}, 0x8) r3 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback, 0x3506}}, 0xe8) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r4, r3, 0x0) 12:45:56 executing program 5 (fault-call:3 fault-nth:15): mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:45:56 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x4000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:45:56 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x2, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 347.479781][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 347.488407][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 347.686510][T26712] FAULT_INJECTION: forcing a failure. [ 347.686510][T26712] name failslab, interval 1, probability 0, space 0, times 0 12:45:56 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x8000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:45:56 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) socket$inet6(0xa, 0x807, 0x7fffffff) [ 347.733039][T26725] binder: 26718:26725 ERROR: BC_REGISTER_LOOPER called without request [ 347.778887][T26712] CPU: 0 PID: 26712 Comm: syz-executor.5 Not tainted 5.0.0-rc8-next-20190301 #1 [ 347.787922][T26712] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 347.797979][T26712] Call Trace: [ 347.801280][T26712] dump_stack+0x172/0x1f0 [ 347.805637][T26712] should_fail.cold+0xa/0x15 [ 347.810720][T26712] ? fault_create_debugfs_attr+0x1e0/0x1e0 [ 347.816549][T26712] ? ___might_sleep+0x163/0x280 [ 347.821427][T26712] __should_failslab+0x121/0x190 12:45:56 executing program 3: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000000)='/dev/zero\x00', 0x400000, 0x0) getsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffff9c, 0x29, 0x23, &(0x7f0000000100)={{{@in=@dev, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@mcast2}, 0x0, @in6=@mcast1}}, &(0x7f0000000040)=0xe8) ioctl$HCIINQUIRY(r0, 0x800448f0, &(0x7f0000000080)={r1, 0x5090, 0x3ff, 0x7f, 0x800, 0x7, 0x7fff}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r3 = socket$inet6(0xa, 0x3, 0x2f) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r4, r3, 0x0) [ 347.826365][T26712] should_failslab+0x9/0x14 [ 347.830868][T26712] kmem_cache_alloc_trace+0x2d1/0x760 [ 347.836242][T26712] ? __kasan_kmalloc.constprop.0+0xcf/0xe0 [ 347.842052][T26712] __memcg_init_list_lru_node+0x8a/0x1e0 [ 347.842073][T26712] __list_lru_init+0x3cf/0x6e0 [ 347.842093][T26712] alloc_super+0x762/0x890 [ 347.842112][T26712] sget_userns+0xf1/0x560 [ 347.852477][T26712] ? get_anon_bdev+0xc0/0xc0 [ 347.852493][T26712] ? get_anon_bdev+0xc0/0xc0 [ 347.852505][T26712] sget+0x10c/0x150 [ 347.852522][T26712] ? ovl_show_options+0x550/0x550 12:45:56 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xe8) r2 = fcntl$dupfd(r0, 0x406, r1) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000080)=@assoc_value={0x0}, &(0x7f0000000100)=0x8) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r2, 0x84, 0x22, &(0x7f0000000140)={0x10000, 0x4, 0x7, 0x2, r3}, 0x10) openat$mixer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/mixer\x00', 0x10000, 0x0) r4 = getpid() setsockopt$ARPT_SO_SET_REPLACE(r2, 0x0, 0x60, &(0x7f00000003c0)={'filter\x00', 0x7, 0x4, 0x4a8, 0x0, 0x0, 0x280, 0x3c0, 0x3c0, 0x3c0, 0x4, &(0x7f0000000280), {[{{@arp={@rand_addr=0x4, @remote, 0xffffffff, 0xffffffff, @empty, {[0xff, 0xff, 0xff, 0x0, 0x0, 0xff]}, @empty, {[0xff, 0xff, 0x0, 0xff, 0xff]}, 0x6, 0x2, 0x9, 0x401, 0x7f, 0x6, 'ipddp0\x00', 'nr0\x00', {0xff}, {0xff}, 0x0, 0x41}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @mac=@remote, @multicast2, @empty, 0x1, 0xffffffff}}}, {{@arp={@multicast1, @multicast2, 0xffffff00, 0xffffff00, @mac, {[0x0, 0x0, 0x0, 0x0, 0xff, 0xff]}, @empty, {[0xff, 0xff, 0x0, 0xff]}, 0x9a, 0xfffffffffffffffb, 0x7, 0x4b68302c, 0x1, 0x2f, 'erspan0\x00', 'bond0\x00', {0xff}, {}, 0x0, 0x18c}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @empty, @empty, 0x0, 0xffffffff}}}, {{@arp={@rand_addr=0x7, @dev={0xac, 0x14, 0x14, 0x2b}, 0xff, 0xffffffff, @mac=@remote, {[0x0, 0x0, 0x0, 0xff, 0xff, 0xff]}, @mac=@dev={[], 0x2b}, {[0xff, 0xff, 0x0, 0xff, 0x0, 0xff]}, 0x8, 0xfff, 0x6, 0x7, 0x1000000, 0x3f, 'veth1_to_bridge\x00', 'bridge0\x00', {}, {}, 0x0, 0x36}, 0xf0, 0x140}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@remote, @empty, @broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x4}}}], {{[], 0xc0, 0xe8}, {0x28}}}}, 0x4f8) mq_notify(r2, &(0x7f0000000040)={0x0, 0x835, 0xffffffffffffbffd, @tid=r4}) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r5, r1, 0x0) getsockopt$inet_pktinfo(r0, 0x0, 0x8, &(0x7f0000000180)={0x0, @rand_addr, @remote}, &(0x7f00000001c0)=0xc) ioctl$sock_inet6_SIOCADDRT(r2, 0x890b, &(0x7f0000000200)={@dev={0xfe, 0x80, [], 0x23}, @loopback, @empty, 0x4e, 0x1ff, 0x1ff, 0x0, 0x9, 0x4800000, r6}) [ 347.852536][T26712] mount_nodev+0x31/0x110 [ 347.852551][T26712] ovl_mount+0x2d/0x40 [ 347.887582][T26712] ? ovl_own_xattr_set+0x10/0x10 [ 347.892520][T26712] legacy_get_tree+0xf2/0x200 [ 347.897204][T26712] vfs_get_tree+0x123/0x450 [ 347.901737][T26712] do_mount+0x1436/0x2c40 [ 347.906082][T26712] ? copy_mount_string+0x40/0x40 [ 347.911033][T26712] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 347.917280][T26712] ? copy_mount_options+0x280/0x3a0 [ 347.922490][T26712] ksys_mount+0xdb/0x150 12:45:56 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xa000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 347.926749][T26712] __x64_sys_mount+0xbe/0x150 [ 347.931440][T26712] do_syscall_64+0x103/0x610 [ 347.936038][T26712] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 347.942051][T26712] RIP: 0033:0x457e29 [ 347.945947][T26712] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 347.965549][T26712] RSP: 002b:00007f3352107c78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 12:45:57 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xe000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 347.973966][T26712] RAX: ffffffffffffffda RBX: 00007f3352107c90 RCX: 0000000000457e29 [ 347.981971][T26712] RDX: 00000000200000c0 RSI: 0000000020000040 RDI: 0000000000400000 [ 347.989941][T26712] RBP: 000000000073bf00 R08: 00000000200002c0 R09: 0000000000000000 [ 347.997914][T26712] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f33521086d4 [ 348.005887][T26712] R13: 00000000004c3c72 R14: 00000000004d6ef0 R15: 0000000000000003 12:45:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:45:57 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = syz_open_dev$cec(&(0x7f0000000000)='/dev/cec#\x00', 0x3, 0x2) ioctl$TUNSETPERSIST(r1, 0x400454cb, 0x1) sysfs$3(0x3) ioctl(r0, 0x200, &(0x7f00000000c0)="0adc1f123c123f3188b070") r2 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r3, r2, 0x0) 12:45:57 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xf000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:45:57 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x3, 0x0) mmap(&(0x7f000000d000/0x3000)=nil, 0x3000, 0x2, 0x30, r0, 0x16) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) 12:45:57 executing program 5 (fault-call:3 fault-nth:16): mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:45:57 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x5421, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 348.595505][T26861] binder: 26858:26861 ioctl c0306201 20000400 returned -14 [ 348.629824][ T7669] binder: release 26858:26861 transaction 81 out, still active 12:45:57 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = dup3(r2, r1, 0x0) ioctl$SNDRV_SEQ_IOCTL_SYSTEM_INFO(r3, 0xc0305302, &(0x7f0000000000)={0x2, 0x40, 0x80, 0x0, 0x3f137845, 0xdf}) 12:45:57 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x10000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 348.643298][ T7669] binder: undelivered TRANSACTION_COMPLETE 12:45:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 348.683898][ T7669] binder: send failed reply for transaction 81, target dead [ 348.756386][T26962] binder: 26960:26962 ioctl c0306201 20000400 returned -14 12:45:57 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008911, &(0x7f0000000140)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x800, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000080)='/dev/rfkill\x00', 0x0, 0x0) ioctl$KVM_GET_SREGS(r2, 0x8138ae83, &(0x7f0000000180)) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000000)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000040)=0x1c) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r3, r1, 0x0) 12:45:57 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x60000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 348.803941][ T7660] binder: release 26960:26962 transaction 83 out, still active [ 348.821820][ T7660] binder: undelivered TRANSACTION_COMPLETE 12:45:57 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) mmap(&(0x7f0000dc4000/0x4000)=nil, 0x4000, 0x2000000, 0x140010, r0, 0x0) r1 = syz_open_dev$vivid(&(0x7f0000000000)='/dev/video#\x00', 0x3, 0x2) ioctl$VIDIOC_ENUM_FRAMESIZES(r1, 0xc02c564a, &(0x7f0000000040)={0xfff, 0x37767f5e, 0x0, @stepwise={0x5, 0x7fff, 0x40, 0x3, 0x80000001, 0x27f6}}) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000000100)={{{@in=@loopback, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@empty}, 0x0, @in6=@ipv4={[], [], @initdev}}}, &(0x7f0000000200)=0xe8) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000240)={0x0, 0x0, 0x0}, &(0x7f0000000280)=0xc) ioctl$TIOCPKT(r2, 0x5420, &(0x7f00000003c0)=0x7ff) setsockopt$bt_rfcomm_RFCOMM_LM(r2, 0x12, 0x3, &(0x7f0000000380)=0x76, 0x4) write$P9_RGETATTR(r3, &(0x7f00000002c0)={0xa0, 0x19, 0x2, {0x2, {0x0, 0x0, 0x4}, 0x10, r4, r5, 0x6, 0x6, 0x2, 0xff, 0x0, 0x6, 0x7, 0x100000001, 0x80000000, 0x100000000, 0xfffffffffffffffb, 0x2, 0x0, 0x40, 0x7}}, 0xa0) clone(0x3, 0x0, 0x0, 0x0, 0x0) 12:45:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 348.904967][ T7660] binder: send failed reply for transaction 83, target dead 12:45:58 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x9effffff, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 348.984782][T26999] binder: 26996:26999 ioctl c0306201 20000400 returned -14 [ 348.995888][ T7669] binder: release 26996:26999 transaction 85 out, still active [ 349.008675][ T7669] binder: undelivered TRANSACTION_COMPLETE 12:45:58 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xc00e0000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:45:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) [ 349.084041][ T7669] binder: send failed reply for transaction 85, target dead [ 349.167734][T27111] binder: 27106:27111 ioctl c0306201 20000400 returned -14 [ 349.185470][T27111] binder: 27106:27111 ioctl c0306201 0 returned -14 [ 349.196140][ T7660] binder: release 27106:27111 transaction 87 out, still active 12:45:58 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 349.217056][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 349.249417][ T7669] binder: send failed reply for transaction 87, target dead [ 349.302985][T27116] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:45:58 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) r1 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_persist_mode\x00', 0x2, 0x0) ioctl$DRM_IOCTL_FREE_BUFS(r1, 0x4010641a, &(0x7f00000000c0)={0x5, &(0x7f0000000040)=[0x6, 0x3, 0x3f, 0x5, 0x0]}) 12:45:58 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x5450, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:45:58 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000)='/dev/hwrng\x00', 0x81, 0x0) getsockopt$inet_IP_IPSEC_POLICY(r0, 0x0, 0x10, &(0x7f0000000100)={{{@in=@multicast1, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@local}, 0x0, @in6=@mcast1}}, &(0x7f0000000200)=0xe8) recvfrom$packet(r2, &(0x7f0000000040)=""/111, 0x6f, 0x23, &(0x7f0000000240)={0x11, 0x1f, r3, 0x1, 0x0, 0x6, @remote}, 0x14) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r4, r1, 0x0) 12:45:58 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xef020000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:45:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 12:45:58 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400002, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:45:58 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xf0ffffff, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 349.454940][T27129] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 349.455099][T27131] binder: 27123:27131 ioctl c0306201 20000400 returned -14 12:45:58 executing program 3: lsetxattr$trusted_overlay_upper(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000200)='trusted.overlay.upper\x00', &(0x7f00000003c0)=ANY=[@ANYBLOB="00fbfe0501f743b61e0b930fc94cadf2bb2248761cf9bf7e58795d55da72372f9ced4301719f5c35cc07ad9c2288195bff88a0d625da9c9e93d5100e286dbd5c8279a1af7b589f4c5d4beefb21f31abace55de90a47df189d246b3f48aa90f5895097c6e3afc36ab8654e15d5f9a6a9443da42c3ecb3a9974692df435ec18394d782667a48c2e14207d76565213a3a17b49cae2056fe40eb9d2c12341a9ca68d5b65fbe972dad07ff14395a91a429cf927303100b86b02203383f682059027dbb9446e645eff86a0ff24111b28bd55a560910c504cccc5c4fab17b2444583ba7c2afa66bc8654770b4580d6bfa87b3cae7d5040289300c9ae436cb1698ec"], 0xfe, 0x2) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x3, &(0x7f0000000240)) r1 = socket$inet6(0xa, 0x3, 0x2f) lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@dev={0xfe, 0x80, [], 0x25}, @in6=@remote, 0x4e23, 0x2, 0x4e20, 0x2, 0xa, 0xa0, 0xa0, 0x2f, 0x0, r2}, {0x8, 0x101, 0x6, 0x4, 0x1f, 0x40, 0xf939, 0x3}, {0x40, 0x7, 0x1, 0x6}, 0x4, 0x6e6bb4, 0x3, 0x0, 0x1, 0x3}, {{@in6=@rand_addr="8b4510a3f40ffeb5684146547a4aed9b", 0x4d2, 0x3f}, 0xa, @in6=@remote, 0x3506, 0x4, 0x0, 0x3, 0x3, 0x0, 0x9}}, 0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r3, r1, 0x0) [ 349.515069][T27136] binder: 27123:27136 ioctl c0306201 0 returned -14 [ 349.543438][ T7669] binder: release 27123:27131 transaction 89 out, still active [ 349.563431][ T7669] binder: undelivered TRANSACTION_COMPLETE 12:45:58 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400003, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:45:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) 12:45:58 executing program 3: r0 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x5, 0x100) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffff9c, 0x84, 0x1d, &(0x7f0000000040)={0x1, [0x0]}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000100)={r1, 0x20, 0x7, [0x8, 0x3, 0x2, 0x0, 0x3f, 0x5a, 0x20]}, 0x16) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r3 = socket$inet6(0xa, 0x3, 0x2f) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000180)=@get={0x1, &(0x7f00000003c0)=""/4096, 0xc962}) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r4, r3, 0x0) 12:45:58 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xfffff000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 349.650928][ T7669] binder: send failed reply for transaction 89, target dead 12:45:58 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) clone(0x7, 0x0, 0x0, 0x0, 0x0) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/audio\x00', 0x800, 0x0) setsockopt$inet6_MRT6_DEL_MFC(r1, 0x29, 0xcd, &(0x7f00000000c0)={{0xa, 0x4e21, 0x0, @remote, 0x101}, {0xa, 0x4e21, 0x80000001, @mcast1, 0xfffffffffffff005}, 0x8, [0x46b9, 0x8, 0x100000001, 0x2, 0xead, 0x10000, 0x9, 0xff]}, 0x5c) [ 349.721890][T27250] binder: 27249:27250 ioctl c0306201 20000400 returned -14 [ 349.739475][T27253] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 349.746567][T27250] binder: 27249:27250 ioctl c0306201 0 returned -14 [ 349.815281][ T7660] binder: release 27249:27250 transaction 91 out, still active [ 349.831292][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 349.878756][ T7660] binder: send failed reply for transaction 91, target dead [ 351.399820][ C1] net_ratelimit: 18 callbacks suppressed [ 351.399829][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 351.411305][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 351.549773][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 351.555531][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 351.629800][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 351.635572][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 352.190279][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 352.196082][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 352.429839][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 352.435645][ C0] protocol 88fb is buggy, dev hsr_slave_1 12:46:01 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x5451, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:01 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) getsockopt$inet_mreq(r0, 0x0, 0x27, &(0x7f0000000000)={@local, @dev}, &(0x7f0000000040)=0x8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) 12:46:01 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400004, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:01 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xffffff7f, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:01 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$FS_IOC_SETFSLABEL(r1, 0x41009432, &(0x7f00000000c0)="dc97018bff705f2d1241feec0872ad7fa801405bc46b6e5e0f50b5d97e74dedb84697d6d079471cc3bf5cf29b810f33e53c1abaacd7d124ee66dcca75d49c57d2600ae13dc78d925c78a67e97f2c6349dc3bbfd9111d2c2f4b9fa4d753fa3fba696554c74ea0f2b01637f7aea916f56ee884cd41df1a6cf312162a7f2b44bed5d77b8097e08680b3bd5cbeea6d698d20550f0c2f58679a869db8e485491586dc966971d5877c620a85ea60d1c4e887cd8918224127d3546b21aea4da5c3739b0dfdbc296e8ab418aacc8cd5f34a0724d39edd0c15df3099bb91a1e4ad6daf973af90e278b0f4c1b939e47bb5ee3f87f65428c9e93d5ecd7d4ae45c239513ee69") r2 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x9, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'gre0\x00', 0x1100}) clone(0x0, 0x0, 0x0, 0x0, 0x0) 12:46:01 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xffffff9e, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 352.582660][T27377] binder: 27374:27377 ioctl c0306201 20000400 returned -14 [ 352.604250][T27381] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 352.630308][ T7660] binder: release 27374:27377 transaction 93 out, still active [ 352.640133][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 352.718351][ T7660] binder: send failed reply for transaction 93, target dead 12:46:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:01 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xfffffff0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:01 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") signalfd4(r0, &(0x7f0000000000)={0x7ff}, 0x8, 0x800) r1 = socket$inet6(0xa, 0x4, 0x31) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) 12:46:01 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400005, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:01 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) [ 352.862572][T27501] binder: 27499:27501 ioctl c0306201 20000400 returned -14 [ 352.898171][T27505] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 352.934209][T27505] overlayfs: filesystem on './file0' not supported as upperdir 12:46:02 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400006, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:02 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x40030000000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:02 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x5452, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:02 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x20001000008910, &(0x7f0000000000)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) rt_sigpending(&(0x7f0000000040), 0x8) dup3(r2, r1, 0x0) 12:46:02 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x1, 0x0) setsockopt$bt_rfcomm_RFCOMM_LM(r1, 0x12, 0x3, &(0x7f00000000c0)=0x2, 0x4) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) [ 353.458701][T27621] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:02 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xf0ffffffffffff, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:02 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040)='/dev/zero\x00', 0x100, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r2, &(0x7f0000000140)={0x7, 0x8, 0xfa00, {r3, 0x7f}}, 0x10) open(&(0x7f0000000000)='./file0\x00', 0x8001, 0x8) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r4, r1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000200)={&(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000000180)="5b44cc672b4f779861b61fbd98c4a82b6aa10dc95d6690572c15d071a7d4d280b92e2d44f481f70ae176b62b468e87e8debdc44008430c53e113b2872ec18fcfd71fa34335e8c751f427093eb81e5668efef0f12", 0x54, r2}, 0x68) [ 353.659945][ T7660] binder: release 27499:27501 transaction 95 out, still active [ 353.675642][ T7660] binder: undelivered TRANSACTION_COMPLETE 12:46:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:02 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400007, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:02 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x100000000000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:02 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) mmap(&(0x7f0000e0f000/0x4000)=nil, 0x4000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) 12:46:02 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000480)="0adc1f123c123b3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) r2 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f0000000240)='/proc/capi/capi20\x00', 0x420141, 0x0) dup2(r1, r1) ioctl$DRM_IOCTL_RES_CTX(0xffffffffffffff9c, 0xc0106426, &(0x7f00000003c0)={0x5, &(0x7f0000000280)=[{}, {}, {}, {}, {0x0}]}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r2, 0x4010641c, &(0x7f0000000440)={r3, &(0x7f0000000400)=""/16}) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_SOCK_GET(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000100)={0xc4, r4, 0x707, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_NODE={0x40, 0x6, [@TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x100000001}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xffffffffffff0000}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x6}, @TIPC_NLA_NODE_ADDR={0x8}]}, @TIPC_NLA_BEARER={0x5c, 0x1, [@TIPC_NLA_BEARER_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7fffffff}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @local}}, {0x14, 0x2, @in={0x2, 0x4e22, @empty}}}}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x7}, @TIPC_NLA_BEARER_NAME={0x18, 0x1, @l2={'ib', 0x3a, 'veth0_to_bridge\x00'}}]}, @TIPC_NLA_MON={0x14, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7e8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3ff}]}]}, 0xc4}, 0x1, 0x0, 0x0, 0x10}, 0x800) ioctl$sock_SIOCGIFBR(r1, 0x8940, &(0x7f00000014c0)=@get={0x1, &(0x7f00000004c0)=""/4096, 0x4}) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) setsockopt$SO_VM_SOCKETS_CONNECT_TIMEOUT(r2, 0x28, 0x6, &(0x7f00000000c0)={0x77359400}, 0x10) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r5, r1, 0x0) [ 353.713548][ T7669] binder: send failed reply for transaction 95, target dead [ 353.772624][T27747] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:02 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x200000000000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:02 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) [ 353.814184][T27756] binder: 27751:27756 ioctl c0306201 20000400 returned -14 12:46:03 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x5460, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:03 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400008, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:03 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x400000000000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:03 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x1}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) 12:46:03 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000040)="0adc1f123c123f3188b070") prctl$PR_SET_SECUREBITS(0x1c, 0x5) setresuid(0x0, 0xee01, 0x0) setpriority(0x2, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) [ 354.407652][T27878] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:03 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x4, 0x3) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = syz_open_dev$amidi(&(0x7f0000000000)='/dev/amidi#\x00', 0x1000, 0x200200) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000080)='IPVS\x00') sendmsg$IPVS_CMD_FLUSH(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0xa8, r3, 0x10, 0x70bd2a, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_DAEMON={0x20, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'hsr0\x00'}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x7}]}, @IPVS_CMD_ATTR_DAEMON={0x18, 0x3, [@IPVS_DAEMON_ATTR_MCAST_IFN={0x14}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x1}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x3}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, [@IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x4}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e21}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @dev={0xac, 0x14, 0x14, 0x13}}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x9}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x1}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @broadcast}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0xfffffffffffffff8}]}, 0xa8}, 0x1, 0x0, 0x0, 0x4000}, 0x40000) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$IPVS_CMD_DEL_SERVICE(r2, &(0x7f0000000540)={&(0x7f0000000240), 0xc, &(0x7f0000000280)={&(0x7f00000003c0)={0x148, r3, 0x300, 0x70bd2d, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_DAEMON={0x64, 0x3, [@IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0x7fff}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x8, 0x8, 0x40}, @IPVS_DAEMON_ATTR_MCAST_GROUP6={0x14, 0x6, @loopback}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x8, 0x7, 0x4e20}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @initdev={0xac, 0x1e, 0x1, 0x0}}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x3}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x8, 0x4, 0xc7c}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'ip_vti0\x00'}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x6}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, [@IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x7ff}, @IPVS_DEST_ATTR_INACT_CONNS={0x8}]}, @IPVS_CMD_ATTR_DEST={0x58, 0x2, [@IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@local}, @IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x5}, @IPVS_DEST_ATTR_WEIGHT={0x8, 0x4, 0x5092}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x4}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x4}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x6}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x8}, @IPVS_DEST_ATTR_PORT={0x8, 0x2, 0x4e20}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x1}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x9}, @IPVS_CMD_ATTR_SERVICE={0x3c, 0x1, [@IPVS_SVC_ATTR_AF={0x8, 0x1, 0xa}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xe4}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x69}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xfffffffffffffeff}, @IPVS_SVC_ATTR_PROTOCOL={0x8, 0x2, 0xbf}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_SCHED_NAME={0x8, 0x6, 'nq\x00'}]}]}, 0x148}, 0x1, 0x0, 0x0, 0x4000000}, 0x10) dup3(r4, r1, 0x80000) ioctl$PPPIOCGL2TPSTATS(r2, 0x80487436, &(0x7f0000000580)="e8e2003be753875b1016c85afc1aac37e9a812ef18b1b3dd4a4b5e44b86a62de2eca281f062a275ba0057b1bc2d8") 12:46:03 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x800000000000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:03 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400009, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:03 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0x842, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) clone(0x0, 0x0, 0x0, 0x0, 0x0) [ 354.609074][ T7660] binder: send failed reply for transaction 97 to 27751:27756 [ 354.649430][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 354.659307][T27998] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 354.677959][ T7660] binder: undelivered TRANSACTION_ERROR: 29189 12:46:03 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x40000a, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:03 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xa00000000000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 354.725090][T28007] binder: 28001:28007 ioctl c0306201 20000400 returned -14 [ 354.876301][T28114] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 355.520183][ T7660] binder: release 28001:28007 transaction 99 out, still active [ 355.527803][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 355.551951][ T7660] binder: send failed reply for transaction 99, target dead [ 356.589798][ C0] net_ratelimit: 22 callbacks suppressed [ 356.589807][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 356.601395][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 357.069860][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 357.075710][ C1] protocol 88fb is buggy, dev hsr_slave_1 12:46:06 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x40049409, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:06 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008911, &(0x7f0000001a40)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) lstat(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, r2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) getsockopt$bt_hci(r0, 0x0, 0x1, &(0x7f0000000140)=""/54, &(0x7f0000000180)=0x36) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = dup3(r1, r3, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r4, 0x810c5701, &(0x7f0000001a80)) bind$pptp(r4, &(0x7f0000000100)={0x18, 0x2, {0x3, @multicast1}}, 0x1e) syz_mount_image$hfs(&(0x7f00000001c0)='hfs\x00', &(0x7f0000000200)='./file0\x00', 0x2, 0xa, &(0x7f00000018c0)=[{&(0x7f00000003c0)="c61224b00c3fa19771447e0ba6b05423bbf7118142f8ce8bb410c0116e6cef5c49ae72c8e471397d74b18f3fc725dff612ba1d4a920a236aa54fb293ae5eef4eb887728b9df49fa7fe7937cefb8b3499f56d6be5c4018ead4abbfa315864b9ee341ad5ed2fd92c4dcaed1612fcc39081192aa4ac1b5ed506f14eba2055a91b8e65b740889594d6c4a28b", 0x8a}, {&(0x7f0000000240)="1063ebc84cfddec7742866c26ace5d527f55f90042129a14ee5cf2b272f41429b70691bac13345bba8f86e6cb4577d58aafd9138cfd9db82271f0bd70d04a3bfb48614a23da2ab5933e716985a1c77fec82f38e94c8f01a7c8a89fdaff428df7", 0x60, 0x1ff}, {&(0x7f0000000480)="5045732c1546469aaca4a3fcff26ba0952c4401799b1f556df27a1302ccbdc555ecd3411b0bc86b46a4c516e81ba662860dc6425ca57ce95faea90bbc29a1db73a006a8b3367ab58661259a7b0d545fe9bc78d1f895c79b627e3585771bae5f2e73c2786e1be3cc65ea4c70dd77d84758b4f63376a6820d90a974fd81898174453cef14d0c1eb3191edd38132c495abb45d7b614f2f9dd9b36980173114dada552de6c969ed0d80f8b7ee2e7f3bfa0a93d841f38f431c38449bf7d4b99068e277893553b213d774c98b643ee868ac2bb43d342b98e27b98793df9173b62d63de3836d432091e4ff69e2e279155545e377d3274dc1287daddf6", 0xf9, 0x3}, {&(0x7f0000000580)="69ae1b", 0x3}, {&(0x7f00000005c0)="ad40f5f50320fae82852a43206ac82f323be33583eb7cff30220ab9e39251017181bda088303afea503c1a7ffdea6df647d198ce6e8c2e0dcad9f6787b86f39ef06ea8f9952ff211211d669677ff89222d2ca79cc843a8b3aafeaa506f9d663323f9efe2ff64fd8dec7baa9cb54e", 0x6e, 0x2}, {&(0x7f0000000640)="4586f9bc5294b41793a1ee0888558d49a6831bf4d0431ed9d064b0e85b7ed2980d4ff435a662aa815027d38da01b0fc6e5734e69a02f933d44f5507f70943e7b9bdb95e9d926284b99727998a99963f4a53a7556e5bc3a681bf8b41418f577d87cdc997c5d48f4dff90f2873673859b89b340e1098bb6a2eb3e1677b246f1dc9879d409d433a64062fd7f73c72a467a885f51c200f09ebd26ebd7830e186b09efc8f679d7fd0fddd033dbbc3fc9ab5805ec2a70107c46a53c03ab255bbc6343b6b1a47446db419472d225743d7d34096162c080c0c67ee56cf388edf11e795f3e674663e3763ad3024a32c1f2d5362a51a07e8cb44af9fa74ec5076450c5cc385d31319f9d383051209a990f1e50feb5ee21ea1e86aa6349127d32aacb23734584a7eda62737ef763fe3bd589831c3d034d4dc14bf02dc60a833802bfe5b0001ae219bd44b5f6b5a9be9bc5d57ee19b306ea3ecd534247015530c152b142b0a847742bc262046f5387f930c841614f331e5492ad6f5726901592109b84b4e5fe0b7aa0a5af68947aba31c44e6fe410c6060cbc789174fde94fee5442d579328f21184b58424d80376b250067b66b496ce1d0d1212ca7898470e3cf2e7a29fd94b89497d90a251360f2ee6144aa10256bb99d8f2357f48ef63e2783619691fb4300c447fdce27cf1a153de6ced407ebb6edcf9db9e2696a59b318c6eb52869119750e0a0976e3e9c4b766dd223e5849d0e747826eba1c351abe17e26aa7edbe8be3fbebc415ff25e93cb06da052c4b8a23795c90a0dbdaeeeff6210ea0035f90779e77fdabf107279c6db56791be05a65ff3c0d177ee714b9a23c8652f5e37c5e3a00a691620859daa344394aa73e8c572b6368fc0581dd40b838e18b4714fa5c821389391019d876b8e91fb1b7937bca7259e341d442a5d86f0ab135e3ae60aba29bf5959fbac0975bc987fedb396ed8ca966e30147cb69c2f2039195c2e44c5487b4d2f692086839498563666d3e299c8c7a430947554c642596a86b3c7d9ac08fa3bd25ebcfabecd3563f605fe3981381de55607b9f93dd88e6dc85585a5e845556c1c89e0466e976edbc3860806efdc1c0f11cde137a9ff6abc99e97393b4ea2e8cef22d363623d165ab93de784d5b8eb08f82b0455f522cb907f88e8b79f179ed3006ebaeed3922c813d3d62db140e62b2c48a5eb7c13ece40a63fe819b79731dbaa4faf3835543c4ba5a3f4986a80251f2d3cc5516c58d5ee056d1b8310ff18099033f5f71d2375907abc0be42e315f28493bec7981a938151d0cb89529ec0d2d2ea0409d41c22c670923fc626696e06949d8e7bb16c71d1b38408ce1b64cf558d13584d03d9560e87b7bab61631adb28bc878fb19c15a534dbeb4cd2ed13696c549828f00ff807a7da6bc38edfb8c573cd475ba64aad22783970388e5b9a837527a488f16462d9f524349ef187b9177698c31365b751679d55ed849cbf8473f61a37e142299861ae66aa0fde4d527952e4e4b0caa18ac177f04a392a8499ffe9d61ffa1f6b33089a6487749ea56eb457b66ad914a2eb5918d3c3ce7b5022196c29a873236e271cf17fff89b800ff199f96c785c9f74c36a7f39262807c666be9352c61af8e1cc67641c926bebba5c923174ee2e3f780345f91b0b6125e15b139e759ae65405d00b230fe661d9466f924ac16b5f93f7e487e5deca05b9c673d71cb5131c15f5a0168c276cde40c19b5f15e5213c5887577ec2f8f7507e476a31439d6600669853456eb6f67164446f7aa41963e015f1aa93c8a88cb6f317bae5b128707f2011334205472de1058f208b48aa45a2420849cf2515278643a020747e0b94a96f94fa89e0329cf1d648629a38a8f8ca8858202e7612e83bbe7488d4bb0a1de6f97d6eeb77cef83bb63a17f56f1901838f7f9a1d0efea2d5ce3fbdad1e197b148ac10c61c9edbcabe586d312a390bdf1d22d9e3b6dbf2923da22e8c09c16a2ae8070da6efe5da163738676f6315398257d159ac45fe2981c6d55979c992d23cb5752401729df38bcb21c0c875c446106fa40f9da7f118171eb4c641a4735b4feb4e7bc9ee2252850adbc2866aad91a39d1a354906d6defadde325234525534a30e9fe06f2a93a74a339439fed502650e1b0a19a5263a30491025174264b813480c38b82b35f87ea320511e5f733f9431dba1f2e6d61e054945c4d4bdae90f7598ba816d176dfdb4db7e162bc4ce706ae6ac9f83838950fbbc31cdf37d3cb3809ba08c2adc5325bd6374acbb5a920c47281cb94f2727b47ddf55e717a6fb79817d9bd0eec5048ddcb416fb727395f4fc689a13ad1c0922788943cb634c621b4d09b583874a60ead1e0901c8070ed7234cc72c88497391f059bd1385146831059ed8adaf311cd72c727348ab130346be6dea0cf3cd5366b6fdbed3a2cf21d38697f97c0001da67ad0171ecd65d86bf82546378422bd8084d2027147abbb970f4031bae0ab8ad0fd9cb583ac493a93073742b01d5e98a25f4dd2b9ea7d8746fe8b913eb153cb51cac099f7fc75213d017b73fe0c0adf9fffe387994283b04864bba278bc87f1e42ec561ad113fa92dfdd4fd0e326d9da7e2049852222a659a2e77d46ce0f66ff3f0673f02297834147bb4dfb54ac8b5651f94eedf2207cee29afe493c50daa39a05c4d5d15e9ba14a559ea20238c340187df116b71d42532cdf8bf6b842b1b145d840dc106c6feedceec3d38cb86be978e4a5b8281d683112cce2cca360800186bdda693d508f42d69c4851e72babe3fbfacfab230f5c92c7e6b492ef67ebdab1002ac7491f6566fdfd558c587a77dc1039b87346aad7274295e12d54de74079797bc0b69e0abc1f51a66128b6726a9b352c3720ffc76db0cd0bcac66b290fb8c2d2b6e93815f42cd566d30a0dc5845e368e9746039a0e97c8cecc9efc7fb2c31250abe491fad3141ec02d5d7c2c25ecfde0ba987d05764fc772dbdfc142416d81b863ddcf20f7a8beb10277606325913f7826a917750c4b548fb786b37fd283d4f519a00c4193ac825b8b9686abe3c83ee9a21231c3885b0bfed58236f4f303dcc59702ce3e211c497c537953cc63a01419572aa03e9aca15c8a645fb694bf0f36471a65e478fb3d59f5fe86f288a7b5049c2f5054f78abb5819e422d6f0b070d7afe5a69582f187c34e4ea59c84f5fd298a6d93ac6bc7824b060b0fe0c5d7c6e11a488fc71bc59a766153f6d976ad269d328e43bb262ed14e08f1ec7f79f31c7b7af8fcc02cab47f3af5d7ca288c667fb0919a8c0747d7a36d504f1a1f9ffc0b4800742c5110be2a2d3234e12847cb104277c06f5db4541821ebdb6834c935b6c948f56d00beb6b33b9dedb5aacc67625ed3f2859795579177c4ed8cad28324d391796607988dc530bbf98575179d2720d6eadd8374629f84c73175f05ba26a4950473262c6668284bdfc8a900df7134265ac9257487d403b6b32188babb92b6881989b2337fd27563b3faf276cf9dea424263d6cb25a953ba2314f609522ad7ad96e8eecf541e059fa1c1ce516092d62ee6603e9e9aed113b90791564ecace3d069ad9039a48b5461e92c37bc93ebb6c9a4366f8f82d917c4205b476dbfc6b01066fded2fdfdca199fef1c986274eeeb269d075853f391fc859ec5687d39c791c352380d27727bd0c32e7f687d09397928c7b21aed53a1c3d02802c21a1c136e0f915db1b6d05fa895a925dc2c00e51edea38bcdac17bb28e01f916b5538f4a19381c0879b46ace6471c2b3110b6ec0d48f1b207f01519b1faabc180a249c332df200a8ab5b64fa25a9ff3384f2b8176f2d7188ac7c3ddb042ba10afa7e5129980419ea2d2d3685162e2384be5beb1add2120febe7ec4622cea777ad4fa9492f3e24ea57a77b804df50b9b0d9c1811479bfc8bc772a501ceb21e8c6c1653d687d31a49e6fbad46974b4f4357914f0b64afb09dc3af3ca43faa7e49583ad9740386ff27dff33587877bc8f73c1e9001083157c3d55db955e4fec2c50d48d34c9dd1cd338a4adbb7e04a2b3b495d7b6251ff57ffa4d5a9be81dbd30e444044ea53c1b88ecedf88ca0317c602787040ba46fc524c84e0871e679981289ed0487b6016db63b878f40a6b865dc21931bd34fdba3c413505167d82eb38be2430d06b6d158bb7c412d3b7edd548bd46fd534debaee515e5cff6396d60102240cbaa97150548a7237532f7978f1d14bd761d0a00d8a89b17f84beae49f3aac0bcf099243273819a779ac1d011c541c8f4b77c9201a1ba85fb947ff487f6bfcf7af0761618fce5f522df52abfca3daf99632a963b33657292633ce8b2c963daef11bdb78cfc4bd4d4c1d692df7f5aa5b552187d982ac36bda39887129b8ca298c5fcb0bda76bf43b9173d1350001aa7db1676353a03d5b61c381bee71e7db8289132cb869ebd95a9aec8aefdd149e4ed883fbb0859628b087fc71050d08cb3cdd75db42c0b6da254a81aba1be56b5198b12be34a2fd1e34b7ac0af0900a4bc54053f84ff850f34a68a780e640b06aa13c2d6a499335c7a5a518b4968715d70bd76310c15c7c0c97cbb62f9fce1685ed4f40b1c975b89115543a315bd8b621896af66abf9e819930375da4323201ca6cbcc1bc16db35da400abc935e17adddd5bfd80faaa84025a65d1608e959e772a34b22317d5439a75826150aa56c79dbec567e75c3167dd1084465cb8d4a9401aebfaec36b8a9f0b37bbc107f96186f708f55e9b48bcbd151a1355b9d6673454d7c5a57113a6d70286b55f190bc56f8c86be2fecfd08554dbbb2c97fb239c02b3313d91e90681a889d0ad691ca9a5b5df789b1f7ff3784be07a3bd83f880d5ff085b6e76e373187ab08204d78f9f801cc2625e5f5b056f31a87e9264ea3bbc469522bbb54a4e5050981f126502c213bfafe18018bd0b4cc496842de3b7ae4d174f7b181d57beafc9907853d59638503f23bd98bc11e0511c4a8d48459de235793abb272b6879dbc2cf354ddb261d6abfef9d8d2c292b67ed9e53dd748033606a23d21226fa598e560b76544f7649690ab26ff5b946839ce1cace590ca2358a8d98637489769cbe19e9008f50af2d85410d7dc9410692c3b9b2b068df0915b6a386546d28bc63d86574d45a540255d2314b87cd07d3a2753754b3aa89d8d5021e25eae8c527306ec7e01eeeb2317b9d9b1a45d190ab8cb4ee5d5ee069704af5011349a22f9029fbef98412c2fadb14afe8b672679515a325b33c8c0172890b928f7d9d8939a5fdb264de19980d5d2173ecfa84f741e3528abea85aa01431760629733dd309d5433fd4b93f532f0c0798af4c5565ade0d99d5141223f493edee6aca367ccc5e0ffe85d3f79839d6a72efab98db47624b96d252b76b6341bd7880bfb1d07d7c05ef30c92b70774fb950a6b4287e3d48377652522c1a5f31e8ccf575af321bf2ffe15b13505ffb5e4595613f88fcd3328f736ef5046a4c182b1f8f2fece39df1c3c6c03c46f44c6f7b6f28b625f6318d1fd897fc28add44aee9c7757c6eb84a5b0c4ace5d6abe50f651b0ef74a460abdca502760c45e97bfdc57d4c5bc9083c1b4b97ecaa1f65d9caf741fdf771e4ebec4e3e1503edfb0296e10522c431d83a20295cb91193e1cbdd971d40e627c5d59cefad96d817604cba96fd4b51a8c7dfdc39bec5b5c116749c9e7457ec492bdc6722133ba00916eeb3c5bf82e5623b39cef687495718e9b3941409b1cc2896d8d2cd41a703655b827592edc31d7543fec575090545", 0x1000, 0x7fffffff}, {&(0x7f0000001640)="36c5e30c238a91c09abf2249ad5ae75aa43b923240f69d75963c2c6eccf315f2af329f801a5f3f7e4b9c9719d291ce20bb36ad03ba05259e21cbdfed71e78f8bfa630b83290b56a2e3c4f95721165e75855d715f5394f516da538d18f47ae47227fecef7ed149cb777608680df4952e92ed6489bbeeb779b9699a983", 0x7c, 0x1}, {&(0x7f00000016c0)="de044a9d12fe6eef809bc852649aa04ec5b3b3ea5d42fd58681351aa9138abdd9560b16dbc1cb9a0dfb5432aceeded060bb78db4c7c991c7573118902239736c91271b23962b87be929f87a18e79bb066312ab7ccd38c39ffdc44be90cdc8d940052bb12173012434d3d018aa4bc3038adf48e899de631558cd0bd6c6ce96233ee20f48aef3f1fd057922e6acaacd41a16096e1d87f28a7f9cd4a2203db583482c075508c16a2a2a1ad8962991be0e429e06ee56d7b82144c6138c1f8296e0ef1a29e57cdbd23da367f96c049663", 0xce, 0xb63}, {&(0x7f00000017c0)="04c3639d414a08d4d78576569b0af8e05d6f4e6d063157fde3a9231a9b6c5bb9dc94d7d9201c56cd7e8a0f321b5d194aa17505580403264c3be1c8b9e1d9f624e10cfe27b57d6b9ed844763ec8a1f0e720de8fc063dc93b82763", 0x5a, 0x2}, {&(0x7f0000001840)="cf2ae78a7ac9920882c3d39e42c75745a38de1995f55be047dd13b8970f67f008f96f98579660a4578159977cfcea5a520897cc247fcb6f1ba644ef3e30da9618e23285079591fe643cca6eaeaa0c753d7", 0x51, 0x40}], 0x4000, &(0x7f00000019c0)={[{@uid={'uid', 0x3d, r2}}], [{@subj_role={'subj_role', 0x3d, 'vmnet1'}}, {@dont_appraise='dont_appraise'}, {@fowner_eq={'fowner', 0x3d, r2}}, {@smackfsdef={'smackfsdef', 0x3d, '\xfe'}}, {@euid_lt={'euid<', r2}}]}) 12:46:06 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xe00000000000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:06 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x40000b, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:06 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x5c832, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) clone(0x4800000, 0x0, 0x0, 0x0, 0x0) 12:46:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x0, &(0x7f0000000140)="06"}) [ 357.462987][T28133] binder: 28127:28133 ioctl c0306201 20000400 returned -14 [ 357.472641][T28131] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 357.507883][T28130] hfs: unable to parse mount options [ 357.518665][ T7669] binder: release 28127:28133 transaction 101 out, still active 12:46:06 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xf00000000000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000), 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:06 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x40000c, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 357.562122][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 357.594028][ T7669] binder: send failed reply for transaction 101, target dead [ 357.632730][T28145] hfs: unable to parse mount options [ 357.634063][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 357.643813][ C1] protocol 88fb is buggy, dev hsr_slave_1 12:46:06 executing program 3: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) accept4$packet(0xffffffffffffffff, &(0x7f0000003180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f00000031c0)=0x14, 0x80000) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f0000003200)={@rand_addr="9d04b84c7c3557497cf0a33ed012cfa8", 0x20, r1}) r2 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r2, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r3 = openat$proc_capi20(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/capi/capi20\x00', 0x101000, 0x0) setsockopt$inet_sctp_SCTP_NODELAY(r3, 0x84, 0x3, &(0x7f0000000200)=0x9, 0x4) mq_timedsend(r3, &(0x7f0000000280), 0x0, 0x7, 0x0) r4 = socket$inet6(0xa, 0x3, 0x2f) ioctl$IOC_PR_PREEMPT_ABORT(r3, 0x401870cc, &(0x7f0000000240)={0x0, 0x7, 0xcb55, 0x3}) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) r6 = dup3(r5, r4, 0x0) getsockopt$EBT_SO_GET_ENTRIES(r6, 0x0, 0x81, &(0x7f0000000100)={'nat\x00', 0x0, 0x4, 0x57, [], 0x4, &(0x7f0000000000)=[{}, {}, {}, {}], &(0x7f0000000040)=""/87}, &(0x7f0000000180)=0x78) [ 357.712881][T28187] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 357.716582][T28191] binder: 28148:28191 ioctl c0306201 20000400 returned -14 12:46:06 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x1000000000000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:06 executing program 4: socket(0x0, 0x0, 0x0) creat(&(0x7f0000000140)='./file0\x00', 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) ioctl$TUNSETPERSIST(0xffffffffffffffff, 0x400454cb, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000280)='system.posix_acl_default\x00', &(0x7f0000000dc0)=ANY=[@ANYBLOB], 0x1, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x40, 0x0) ioctl$LOOP_CTL_REMOVE(r0, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r0, 0x4c80, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(0xffffffffffffffff, 0x6611) [ 357.789896][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 357.795726][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 357.879833][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 357.885656][ C1] protocol 88fb is buggy, dev hsr_slave_1 12:46:07 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x6000000000000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:07 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x4020940d, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:07 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x40000d, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:07 executing program 4: socket(0x0, 0x0, 0x0) r0 = creat(&(0x7f0000000140)='./file0\x00', 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040), &(0x7f00000000c0)=0x1b8) ioctl$TUNSETPERSIST(0xffffffffffffffff, 0x400454cb, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000280)='system.posix_acl_default\x00', &(0x7f0000000dc0)=ANY=[@ANYBLOB="100002000000000020000400000000"], 0x1, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x40, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(0xffffffffffffffff, 0x6611) 12:46:07 executing program 3: recvmmsg(0xffffffffffffffff, &(0x7f0000007380)=[{{&(0x7f0000000080)=@nfc, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000100)=""/226, 0xe2}, {&(0x7f0000000200)=""/112, 0x70}, {&(0x7f00000003c0)=""/116, 0x74}, {&(0x7f0000000440)=""/108, 0x6c}, {&(0x7f00000004c0)=""/239, 0xef}, {&(0x7f0000000280)=""/21, 0x15}], 0x6, &(0x7f0000000640)=""/141, 0x8d}, 0x9}, {{&(0x7f0000000700)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @dev}, 0x80, &(0x7f0000001a80)=[{&(0x7f0000000780)=""/47, 0x2f}, {&(0x7f00000007c0)=""/131, 0x83}, {&(0x7f0000000880)=""/151, 0x97}, {&(0x7f0000000940)=""/197, 0xc5}, {&(0x7f0000000a40)=""/52, 0x34}, {&(0x7f0000000a80)=""/4096, 0x1000}], 0x6, &(0x7f0000001b00)=""/20, 0x14}, 0x100000001}, {{&(0x7f0000001b40)=@alg, 0x80, &(0x7f0000001ec0)=[{&(0x7f0000001bc0)=""/188, 0xbc}, {&(0x7f0000001c80)=""/67, 0x43}, {&(0x7f0000001d00)=""/209, 0xd1}, {&(0x7f0000001e00)=""/155, 0x9b}], 0x4, &(0x7f0000001f00)=""/55, 0x37}, 0x3}, {{&(0x7f0000001f40)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @initdev}}}, 0x80, &(0x7f0000004380)=[{&(0x7f0000001fc0)=""/72, 0x48}, {&(0x7f0000002040)=""/215, 0xd7}, {&(0x7f0000002140)=""/4096, 0x1000}, {&(0x7f0000003140)=""/214, 0xd6}, {&(0x7f0000003240)=""/91, 0x5b}, {&(0x7f00000032c0)=""/29, 0x1d}, {&(0x7f0000003300)=""/71, 0x47}, {&(0x7f0000003380)=""/4096, 0x1000}], 0x8, &(0x7f0000004400)=""/203, 0xcb}, 0x9}, {{&(0x7f0000004500)=@in={0x2, 0x0, @initdev}, 0x80, &(0x7f0000004740)=[{&(0x7f0000004580)=""/218, 0xda}, {&(0x7f0000004680)=""/167, 0xa7}], 0x2, &(0x7f0000004780)=""/137, 0x89}, 0x9}, {{&(0x7f0000004840)=@alg, 0x80, &(0x7f0000005e00)=[{&(0x7f00000048c0)=""/177, 0xb1}, {&(0x7f0000004980)=""/254, 0xfe}, {&(0x7f0000004a80)=""/75, 0x4b}, {&(0x7f0000004b00)=""/55, 0x37}, {&(0x7f0000004b40)=""/124, 0x7c}, {&(0x7f0000004bc0)=""/87, 0x57}, {&(0x7f0000004c40)=""/162, 0xa2}, {&(0x7f0000004d00)=""/204, 0xcc}, {&(0x7f0000004e00)=""/4096, 0x1000}], 0x9, &(0x7f0000005ec0)=""/184, 0xb8}, 0xfff}, {{&(0x7f0000005f80)=@l2, 0x80, &(0x7f0000006080)=[{&(0x7f0000006000)=""/54, 0x36}, {&(0x7f0000006040)=""/3, 0x3}], 0x2, &(0x7f00000060c0)=""/8, 0x8}, 0x2914d9d2}, {{&(0x7f0000006100)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @remote}}}, 0x80, &(0x7f0000007240)=[{&(0x7f0000006180)=""/4096, 0x1000}, {&(0x7f0000007180)=""/145, 0x91}], 0x2, &(0x7f0000007280)=""/254, 0xfe}, 0xb7}], 0x8, 0x40000000, 0x0) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000007580)={0x0, 0x1}, &(0x7f00000075c0)=0x8) bind$isdn_base(r0, &(0x7f0000007640)={0x22, 0x9, 0x3ff, 0x0, 0x1}, 0x6) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r1, 0x84, 0x10, &(0x7f0000007600)=@assoc_value={r2, 0x7}, 0x8) r3 = syz_open_dev$vbi(&(0x7f0000000000)='/dev/vbi#\x00', 0x2, 0x2) ioctl$KDENABIO(r1, 0x4b36) setsockopt$IP_VS_SO_SET_FLUSH(r3, 0x0, 0x485, 0x0, 0x0) r4 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r4, 0x1000008910, &(0x7f0000000040)="0a0600123c123f3188b070") r5 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r5, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r6, r5, 0x8000) write$apparmor_current(r0, &(0x7f0000007680)=@profile={'changeprofile ', 'bdevwlan0\x00'}, 0x18) [ 358.350992][T28383] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:07 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSIFPFLAGS(r0, 0x8934, &(0x7f0000000000)={'caif0\x00'}) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = dup3(r2, r1, 0x0) ioctl$SG_GET_REQUEST_TABLE(r3, 0x2286, &(0x7f0000000100)) 12:46:07 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x9effffff00000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) 12:46:07 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400011, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:07 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xc00e000000000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 358.490018][ T7660] binder: release 28148:28191 transaction 103 out, still active [ 358.497747][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 358.509582][ T7660] binder: send failed reply for transaction 103, target dead 12:46:07 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xef02000000000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:07 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x5, 0xffff) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) [ 358.661804][T28508] binder: 28505:28508 ioctl c0306201 20000400 returned -14 [ 358.662339][T28503] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 358.678722][T28508] binder: 28505:28508 ERROR: BC_REGISTER_LOOPER called without request [ 358.689414][ T7669] binder: release 28505:28508 transaction 105 out, still active 12:46:07 executing program 4: bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000140)={0xffffffffffffffff, 0x0, &(0x7f00000000c0)=""/1}, 0x18) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r0, 0x89f0, &(0x7f0000000140)='sit0\x00') perf_event_open(&(0x7f0000000180)={0x2, 0x70, 0x3e8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'ip_vti0\x00', 0x43732e539c417f1a}) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_SET_FILTER(r1, 0x89f1, &(0x7f0000000140)='sit0\x00') [ 358.731285][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 358.811857][ T7669] binder: send failed reply for transaction 105, target dead 12:46:10 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa02, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) 12:46:10 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x40003a, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:10 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x0) fdatasync(r1) sendfile(r1, r0, &(0x7f0000000080)=0x2, 0x80000002) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = dup3(r2, r1, 0x0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000040)) ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000000)=r3) socket$inet6_tcp(0xa, 0x1, 0x0) fdatasync(r1) 12:46:10 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xf0ffffff00000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:10 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_ENABLE_CAP_CPU(r3, 0xc008ae88, &(0x7f0000000000)={0x3, 0x600000000000000, [0x40000071], [0xc2]}) [ 361.466669][T28628] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 361.477873][T28636] binder: 28634:28636 ioctl c0306201 20000400 returned -14 12:46:10 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xffffff7f00000000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:10 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400048, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 361.507561][T28636] binder: 28634:28636 ERROR: BC_REGISTER_LOOPER called without request [ 361.532849][ T7660] binder: release 28634:28636 transaction 107 out, still active [ 361.553503][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 361.564057][T28654] FAULT_FLAG_ALLOW_RETRY missing 21 [ 361.569316][T28654] CPU: 0 PID: 28654 Comm: syz-executor.2 Not tainted 5.0.0-rc8-next-20190301 #1 [ 361.578335][T28654] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 361.588386][T28654] Call Trace: [ 361.591704][T28654] dump_stack+0x172/0x1f0 [ 361.596112][T28654] handle_userfault.cold+0x41/0x5d [ 361.601240][T28654] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 12:46:10 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0xfffffffffffff000, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 361.607050][T28654] ? debug_check_no_obj_freed+0x211/0x444 [ 361.612786][T28654] ? _raw_spin_unlock_irqrestore+0x6b/0xe0 [ 361.618599][T28654] ? userfaultfd_ioctl+0x3aa0/0x3aa0 [ 361.623901][T28654] ? trace_hardirqs_on+0x67/0x230 [ 361.625909][ T7660] binder: send failed reply for transaction 107, target dead [ 361.628948][T28654] ? kasan_check_read+0x11/0x20 [ 361.641236][T28654] ? mark_held_locks+0xa4/0xf0 [ 361.646006][T28654] ? free_unref_page+0x476/0x600 [ 361.650953][T28654] ? __free_pages+0x72/0xb0 12:46:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, 0x0}) [ 361.655456][T28654] ? free_unref_page+0x476/0x600 [ 361.660396][T28654] ? lockdep_hardirqs_on+0x418/0x5d0 [ 361.660415][T28654] ? trace_hardirqs_on+0x67/0x230 [ 361.660447][T28654] do_huge_pmd_anonymous_page+0x97d/0x1730 [ 361.660473][T28654] ? __thp_get_unmapped_area+0x190/0x190 [ 361.660492][T28654] ? perf_trace_lock+0xeb/0x510 [ 361.660513][T28654] __handle_mm_fault+0x2d5e/0x3ec0 [ 361.676616][T28654] ? vmf_insert_mixed_mkwrite+0x40/0x40 [ 361.676646][T28654] ? find_held_lock+0x35/0x130 [ 361.676661][T28654] ? handle_mm_fault+0x322/0xb30 [ 361.676697][T28654] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 361.692239][T28654] ? kasan_check_read+0x11/0x20 [ 361.702519][T28654] handle_mm_fault+0x43f/0xb30 [ 361.702539][T28654] __get_user_pages+0x7b6/0x1a40 [ 361.702567][T28654] ? follow_page_mask+0x19a0/0x19a0 [ 361.702592][T28654] ? get_user_pages_unlocked+0x1e1/0x440 [ 361.725927][T28755] binder: 28754:28755 ioctl c0306201 20000400 returned -14 [ 361.728253][T28654] get_user_pages_unlocked+0x20a/0x440 [ 361.728277][T28654] ? get_user_pages_longterm+0x10d0/0x10d0 12:46:10 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioperm(0x0, 0x401, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 361.728290][T28654] ? get_user_pages_fast+0x1fd/0x3b0 [ 361.728305][T28654] ? lockdep_hardirqs_on+0x418/0x5d0 [ 361.728320][T28654] ? trace_hardirqs_on+0x67/0x230 [ 361.728346][T28654] get_user_pages_fast+0x2e9/0x3b0 [ 361.740270][T28755] binder: 28754:28755 ERROR: BC_REGISTER_LOOPER called without request [ 361.746324][T28654] ? __get_user_pages_fast+0x370/0x370 [ 361.746383][T28654] ? unlock_request.part.0+0x78/0x90 [ 361.746408][T28654] iov_iter_get_pages+0x2c3/0xfb0 [ 361.746427][T28654] ? lock_downgrade+0x880/0x880 [ 361.786558][T28654] ? iov_iter_fault_in_readable+0x450/0x450 [ 361.786575][T28654] ? do_raw_spin_unlock+0x57/0x270 [ 361.786591][T28654] ? _raw_spin_unlock+0x2d/0x50 [ 361.786611][T28654] fuse_copy_fill+0x689/0x930 [ 361.786629][T28654] ? fuse_copy_finish+0x340/0x340 [ 361.786645][T28654] ? fuse_dev_do_read.isra.0+0x1132/0x1ef0 [ 361.786665][T28654] ? find_held_lock+0x35/0x130 [ 361.792194][ C1] net_ratelimit: 18 callbacks suppressed [ 361.792208][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 361.797383][T28654] ? fuse_dev_do_read.isra.0+0x1132/0x1ef0 [ 361.802447][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 361.807716][T28654] fuse_copy_one+0xe3/0x180 [ 361.827717][T28654] ? fuse_copy_fill+0x930/0x930 [ 361.827732][T28654] ? lock_downgrade+0x880/0x880 [ 361.827753][T28654] ? kasan_check_read+0x11/0x20 [ 361.827769][T28654] ? do_raw_spin_unlock+0x57/0x270 [ 361.827788][T28654] fuse_dev_do_read.isra.0+0x1173/0x1ef0 [ 361.827806][T28654] ? __sanitizer_cov_trace_switch+0x49/0x80 [ 361.827842][T28654] ? fuse_dev_release+0x490/0x490 [ 361.837483][ T7660] binder: release 28754:28755 transaction 109 out, still active [ 361.838638][T28654] ? find_held_lock+0x35/0x130 [ 361.838657][T28654] ? aa_file_perm+0x40b/0xeb0 [ 361.838682][T28654] ? memset+0x32/0x40 [ 361.838717][T28654] fuse_dev_read+0x161/0x1f0 [ 361.838732][T28654] ? fuse_dev_splice_read+0x5e0/0x5e0 [ 361.838754][T28654] ? aa_file_perm+0x432/0xeb0 [ 361.845615][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 361.849150][T28654] ? aa_path_link+0x460/0x460 [ 361.849164][T28654] ? find_held_lock+0x35/0x130 12:46:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, &(0x7f0000000140)}) [ 361.849179][T28654] ? __sanitizer_cov_trace_const_cmp8+0x18/0x20 [ 361.849192][T28654] ? iov_iter_init+0xea/0x220 [ 361.849211][T28654] new_sync_read+0x4c4/0x740 [ 361.849230][T28654] ? do_iter_readv_writev+0x8e0/0x8e0 [ 361.849253][T28654] ? __fget+0x381/0x550 [ 361.875822][T28654] ? security_file_permission+0x94/0x380 [ 361.875845][T28654] __vfs_read+0xe4/0x110 [ 361.875867][T28654] vfs_read+0x194/0x3e0 [ 361.875888][T28654] ksys_read+0xea/0x1f0 [ 361.875907][T28654] ? kernel_write+0x120/0x120 [ 361.875931][T28654] ? do_syscall_64+0x26/0x610 [ 361.896335][T28654] ? entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 361.896350][T28654] ? do_syscall_64+0x26/0x610 [ 361.896374][T28654] __x64_sys_read+0x73/0xb0 [ 361.896392][T28654] do_syscall_64+0x103/0x610 [ 361.896410][T28654] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 361.896422][T28654] RIP: 0033:0x457e29 [ 361.896442][T28654] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 361.906008][ T7660] binder: send failed reply for transaction 109, target dead [ 361.907342][T28654] RSP: 002b:00007f8aa7efdc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 361.907357][T28654] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457e29 [ 361.907380][T28654] RDX: 0000000000000072 RSI: 0000000020465f8e RDI: 0000000000000004 [ 361.907390][T28654] RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 [ 361.907399][T28654] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8aa7efe6d4 12:46:11 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa03, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:11 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") socket$inet6(0xa, 0x7, 0x1f) r1 = socket$inet6(0xa, 0x8000a, 0x6) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000080)='/dev/dlm-control\x00', 0x10000, 0x0) ioctl$SIOCRSSCAUSE(r2, 0x89e1, &(0x7f0000000100)=0xe4f5558) pipe2(&(0x7f0000000000)={0xffffffffffffffff}, 0x4000) ioctl$TIOCGPGRP(r3, 0x540f, &(0x7f0000000200)) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000180)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_PRI(r2, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x880000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x30, r4, 0x200, 0x70bd2a, 0x25dfdbfd, {{}, 0x0, 0x4108, 0x0, {0x14, 0x18, {0x1, @bearer=@udp='udp:syz2\x00'}}}, ["", "", "", "", ""]}, 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x20000041) syz_init_net_socket$netrom(0x6, 0x5, 0x0) openat$vimc0(0xffffffffffffff9c, &(0x7f0000000040)='/dev/video0\x00', 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) [ 361.907409][T28654] R13: 00000000004c3963 R14: 00000000004d8450 R15: 00000000ffffffff [ 361.949829][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 362.029801][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 362.031884][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 362.037789][ C1] protocol 88fb is buggy, dev hsr_slave_1 12:46:11 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 362.153383][T28802] binder: 28768:28802 ioctl c0306201 20000400 returned -14 [ 362.173193][T28802] binder: 28768:28802 ERROR: BC_REGISTER_LOOPER called without request [ 362.190256][ T7660] binder: release 28768:28802 transaction 111 out, still active 12:46:11 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x40004c, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:11 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000500)=[@textreal={0x8, &(0x7f0000000080)="baa100b000eef36cba2100ec66b9800000c00f326635001000000f30bad104ecc80080d267d9f8f30f1bb429000f20c06635200000000f22c067f3af", 0x3c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f00000006c0)={0x0, 0x0, @pic={0x0, 0xfffffffffffffffd}}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socket$inet(0x2, 0x0, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x484b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[], 0x0, 0x680}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 362.205591][ T7660] binder: undelivered TRANSACTION_COMPLETE 12:46:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, &(0x7f0000000140)}) [ 362.242976][ T7660] binder: send failed reply for transaction 111, target dead 12:46:11 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 362.310190][T28881] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 362.315590][T28886] binder: 28885:28886 ioctl c0306201 20000400 returned -14 [ 362.363626][T28908] binder: 28885:28908 ERROR: BC_REGISTER_LOOPER called without request [ 362.392175][ T7669] binder: release 28885:28886 transaction 113 out, still active 12:46:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x0, 0x0, &(0x7f0000000140)}) 12:46:11 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 362.414641][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 362.449424][ T7669] binder: send failed reply for transaction 113, target dead 12:46:11 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = syz_open_dev$mice(&(0x7f0000000000)='/dev/input/mice\x00', 0x0, 0x109800) accept$packet(0xffffffffffffffff, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000080)=0x14) ioctl$sock_inet6_SIOCADDRT(r1, 0x890b, &(0x7f0000000100)={@mcast2, @rand_addr="f24e9aa1ea094b53da2e0759d6b19840", @ipv4={[], [], @multicast1}, 0x5, 0x80000000, 0x8, 0x100, 0x9, 0x4120120, r2}) r3 = socket$inet6(0xa, 0x3, 0x800000000020002f) ioctl$UI_SET_MSCBIT(r1, 0x40045568, 0x2e) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r4, r3, 0x0) 12:46:11 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x40005c, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 362.493200][T28985] binder: 28981:28985 ioctl c0306201 20000400 returned -14 [ 362.513523][T28985] binder: 28981:28985 ERROR: BC_REGISTER_LOOPER called without request 12:46:11 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000240)={[{0x1bbc, 0x1, 0xa5, 0x39, 0x86, 0xffffffffffffffff, 0xffffffffffffffff, 0x62cd, 0x2, 0x0, 0x9, 0x3, 0x200}, {0xdd46, 0x2, 0x5, 0xc8, 0x4, 0x0, 0x1000, 0x0, 0x4, 0x51, 0x0, 0x5, 0x101}, {0x16b, 0xca0c4bb, 0x7fff, 0xded, 0x7, 0x7, 0x900, 0x3, 0x6, 0x3, 0xffffffffffff07d0, 0x1f, 0x7}], 0x5}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r3, 0x8912, 0x400200) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000100)={0x0, 0x100000}) ioctl$KVM_GET_REG_LIST(0xffffffffffffffff, 0xc008aeb0, &(0x7f0000000040)=ANY=[@ANYBLOB="0f80"]) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000028000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x10001, 0x2, 0x6001, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f00000001c0)={[{0x40000000, 0x1, 0x3, 0xfffffffffffffffb, 0x7, 0xffffffffffffffc0, 0x2, 0x9, 0x7, 0x0, 0x7, 0x300000, 0x7fff}, {0x2, 0x100, 0x5, 0x8, 0xde, 0x81, 0x1, 0x572, 0x7f, 0x4, 0x7fffffff, 0x401, 0x101}, {0x0, 0x80, 0x4800000, 0x5, 0x6, 0xec4, 0xfffffffffffffffc, 0x5, 0x4bf5, 0x38e920e0, 0x8, 0x1f, 0x7f}], 0x7}) ioctl$KVM_RUN(r2, 0xae80, 0x0) [ 362.589995][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 362.595856][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 362.626477][T29015] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 362.627221][ T7669] binder: release 28981:28985 transaction 115 out, still active [ 362.661042][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 362.676785][ T7669] binder: send failed reply for transaction 115, target dead [ 362.829903][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 362.835750][ C0] protocol 88fb is buggy, dev hsr_slave_1 12:46:11 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400060, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:11 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:11 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa04, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:11 executing program 4: personality(0x500000) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x10400000000003, 0x32, 0xffffffffffffffff, 0x0) r0 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000000)='/dev/vfio/vfio\x00', 0x101000, 0x0) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_PEER_REMOVE(r0, &(0x7f0000000340)={&(0x7f0000000040), 0xc, &(0x7f0000000300)={&(0x7f00000003c0)=ANY=[@ANYBLOB="20020000", @ANYRES16=r1, @ANYBLOB="00012cbd7000fbdbdf2514000000840101005400020008000100170000000800020002000000080002008c1f0000080002000100000008000300e90e00000800030000ffffff08000400070000000800040077c9000008000400ffffffff080002000400000034000200080001000100000008000300010000000800020000800000080002000900000008000300040000000800010018000000100001007564703a73797a30000000002c0004001400010002004e22ac1e010100000000000000001400020002004e22ac1414bb000000000000000038000400200001000a004e220000000400000000000000000000ffff7f000001550500001400020002004e22ac1414bb00000000000000003c000200080001001d000000080001000300000008000100110000000800040009000000080004004000000008000200070000000800020013f0ffff100001006574683a766574683100000038000400200001000a004e21000090a5fbc31f76150b4c0c2a07e723f848ed91010000801400020002004e22ac1414aa0000000000000000100004000c00010073797a31000000004000060008000100200000000800010001040000080001000500000004000200080001003c3800000800010002000000080001000600000008000100060000000c00050008000100657468002c00020008000100000000000400040008000100ffff0000080001000900000004000400080002000600000001b34b24a0171f2980605b79d3f120a5f31b23387a67aeb60d87605f75dca044270b0af29fe69e382e65056bb9ffdb7d15ba572f7fc2813d0b5f0e87eaf895d9aae6f66c90383c2b9780c88352a9d0de3a099fbc1010dea3e1906ba156b8bf7e7df1984443d19d7d13fad601753f41fddf435089f4bf611b849904945f07d9ddd8501e23e5007a7d4e1df5ed47c4d9a3abd54cceea92841eeebeb4e6f6900f650a8022617b9ab7e919c1488d"], 0x220}, 0x1, 0x0, 0x0, 0x20000081}, 0x8000) ioctl$BLKFLSBUF(r0, 0x1261, &(0x7f00000000c0)=0x2) 12:46:11 executing program 1 (fault-call:5 fault-nth:0): r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:11 executing program 3: socketpair(0x1e, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'batadv0\x00', &(0x7f0000000480)=ANY=[@ANYBLOB="4600000009000000a69d0000ffffff7f03688951ffffffff40000000ff0000000900000001000080080000000100000005000000020000000000000004000000"]}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r2 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback, 0x10000000000000}}, 0xe8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r3, r2, 0x0) 12:46:12 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008911, &(0x7f0000000080)) r1 = socket$inet6(0xa, 0x3, 0x2f) r2 = dup3(r0, r1, 0x80000) ioctl$DRM_IOCTL_INFO_BUFS(r2, 0xc0106418, &(0x7f0000000000)={0x4, 0x81, 0x4, 0x80000000, 0x8, 0x81}) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) setsockopt$inet_group_source_req(r0, 0x0, 0x2f, &(0x7f0000000100)={0x9bf8, {{0x2, 0x4e23, @rand_addr=0x8001}}, {{0x2, 0x4e24, @rand_addr=0x1}}}, 0x108) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r3, r1, 0x0) [ 363.006784][T29138] binder: 29128:29138 ioctl c0306201 20000400 returned -14 [ 363.034457][T29133] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 363.047975][T29138] binder: 29128:29138 ERROR: BC_REGISTER_LOOPER called without request 12:46:12 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:12 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) connect$vsock_stream(0xffffffffffffffff, 0x0, 0x0) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/cachefiles\x00', 0x10200, 0x0) ioctl$sock_bt_cmtp_CMTPGETCONNLIST(r0, 0x800443d2, &(0x7f0000000880)={0x3, &(0x7f0000000700)=[{}, {}, {}]}) clone(0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(0xffffffffffffffff, 0xc1205531, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, [], [], [], 0x1, 0x0, 0x0, 0x0, "9acbda68b9e6eaf201883ed741b93e44"}) ioctl$KVM_S390_INTERRUPT_CPU(0xffffffffffffffff, 0x4010ae94, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000000)='/dev/snd/controlC#\x00', 0x0, 0x0) ioctl$TUNDETACHFILTER(r0, 0x401054d6, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r1, 0xc1205531, &(0x7f0000002040)=""/4096) [ 363.132039][ T7669] binder: release 29128:29138 transaction 117 out, still active 12:46:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:12 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) getsockname$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in6=@rand_addr="17248a9cdcfa047c818a19f97221ce03", 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x1, r2}, {}, {}, 0x0, 0x0, 0x1, 0x0, 0xffffffffffffffff}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in6=@ipv4={[], [], @local}}}, 0xe8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r3, r3, 0x80000) 12:46:12 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400068, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 363.176672][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 363.210085][ T7669] binder: release 29128:29138 transaction 117 in, still active 12:46:12 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 363.227679][ T7669] binder: send failed reply for transaction 117, target dead [ 363.260151][T29255] binder: 29254:29255 ioctl c0306201 20000400 returned -14 [ 363.289006][T29255] binder: 29254:29255 ERROR: BC_REGISTER_LOOPER called without request [ 363.338154][T29260] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 363.341613][ T7669] binder: release 29254:29255 transaction 119 out, still active [ 363.387635][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 363.420850][ T7669] binder: release 29254:29255 transaction 119 in, still active [ 363.444291][ T7669] binder: send failed reply for transaction 119, target dead 12:46:12 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:12 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x4e24, 0x81, 0xa, 0x0, 0x0, 0x62}, {0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, {}, 0x40000000, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x2000000000000000, @in=@loopback, 0x4}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) 12:46:12 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0xc0045878, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:12 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x40006c, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x2, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:12 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:12 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000000)={0xffffffffffffff9c}) r1 = dup3(r0, r0, 0x80000) ioctl$RTC_IRQP_READ(r1, 0x8008700b, &(0x7f0000000080)) setsockopt$SO_VM_SOCKETS_BUFFER_MAX_SIZE(r0, 0x28, 0x2, &(0x7f0000000040)=0x5, 0x8) clock_adjtime(0x0, &(0x7f0000000300)) r2 = syz_open_dev$video4linux(&(0x7f00000000c0)='/dev/v4l-subdev#\x00', 0x2, 0x200000) ioctl$VIDIOC_S_MODULATOR(r2, 0x40445637, &(0x7f0000000100)={0x5, "0e24f8b46c22d22dcc2918c6106b1e172d948d45df267e5effe9616fad325a03", 0x80, 0x8, 0x0, 0x8, 0x1}) [ 363.914312][T29379] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 363.931549][T29388] binder: 29378:29388 ioctl c0306201 20000400 returned -14 12:46:13 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000040)={0x0}, &(0x7f0000000080)=0xc) ioprio_get$pid(0x3, r2) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r3, r1, 0x0) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/qat_adf_ctl\x00', 0x400, 0x0) [ 363.965129][T29424] binder_alloc: binder_alloc_mmap_handler: 29378 20001000-20004000 already mapped failed -16 12:46:13 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400074, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:13 executing program 4: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/fuse\x00', 0x2, 0x0) mount$fuse(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='fuse\x00', 0x0, &(0x7f0000000380)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id'}, 0x2c, {'group_id'}, 0x2c, {[{@max_read={'max_read'}}]}}) socket$vsock_dgram(0x28, 0x2, 0x0) [ 364.008423][T29388] binder: BINDER_SET_CONTEXT_MGR already set [ 364.039384][T29388] binder: 29378:29388 ioctl 40046207 0 returned -16 12:46:13 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x40007a, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:13 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 364.099070][T29505] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 364.114308][ T7660] binder: release 29378:29388 transaction 121 out, still active [ 364.123460][ T7660] binder: undelivered TRANSACTION_COMPLETE 12:46:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x5, &(0x7f00000000c0)="0adc1f123c12c372b0494e") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) [ 364.152800][ T7660] binder: send failed reply for transaction 121, target dead [ 364.235159][T29541] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:13 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0xc0045878, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:13 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x5421, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:13 executing program 4: socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)) r0 = syz_open_dev$vcsa(&(0x7f0000001680)='/dev/vcsa#\x00', 0x2, 0x105000) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x4a) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, &(0x7f00000014c0)={{{@in6=@ipv4, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@ipv4={[], [], @remote}}}, &(0x7f00000015c0)=0xe8) syz_mount_image$hfs(&(0x7f0000000380)='hfs\x00', &(0x7f00000003c0)='./file0\x00', 0x8, 0x2, &(0x7f0000001480)=[{&(0x7f0000000400)="44b8ab8b15bccaae0b97ec9a88d8998628f34325257646ad560e83ea858ce5e9e1f7485718506f39df4fe31f8c401db93fc31f6c6e4736c9209c7525a27df18659257ea60e8cee66494942164a41d2c7803ccba6f388a907b90a9f521ae0918c", 0x60, 0xfffffffffffffffe}, {&(0x7f0000000480)="2349490954433790c7447597ccedfaf00068dd93ffe303b8c342f6b91d4f6e8734999f7ef93edb23c005552d47c95046df9ef19def603094c39853f4fb28a5c3a195ee9ec27aa1be33c21b32588e55a7382c3dc89b64c48dc56ecd31a6d1a70c6140bd7c1e83c86c49b3ff7b05767f74607bbb42e77ad1eaf8fe921d4c61f19f9516ea92d1c9ef92eacf6ae2365e993382a32a9ede6fe4ee623116559e28e75320608b84cb0de161b3dca25dcb9e4d46099bed45ea47f41d1e6aef1a1d7b26404c1d81207cb5982543ae3a5443a8e170de58727c9a23f4f842a1301ec2c5cef192b79ab0668ee508edbd2e307f1cb1e71ab56b1544176aeb8e90a7e9be201d364d99311db019c9f2fbb404c2e9270098bcab56c1a4bbda2bd1faa91c1184fdb8c2457aefe42f8469b8ed5fea6440c8194c36e9094f4b80d6f187b58e4e5ac3facaad1fcd991d602a1fd0c78e561a4a758f5dcd3de80b7d0b901eb9bd5e5efc3966dd6d6ce55d98f71e750cfa3eb26b8ac2c678b3c9a49e58251aef640401166d7f3389053ce6c449b5f957b86a59539b4c149849edb65aa79fa43b30eb65a6d8b8febb5920cf91edd5689d196c163f5e7c7d893c38a95a824d4491936ea6e45c53de025e855baf1400f08eed63f54916c01c3be5a6512d1cfb4b7e30ad53d88a90ac51f6718f8c99f371f7b83f5196bc59125c1f4b06ef2ac0984944ec49cabc7e0650f3eddd9d93ded2b6cd5f04ce7444d184b7aa9503aaea440b1c125860e0e7a0cae301c2741aeef1671763484d1d55386b1d6cd5b6dd8f37936d7753a711628f4d344a21130012bc2ea817f7627c04690039ad2baa67fc87b747e7dd1f6dbfd8672181209b455005b585ab594ffda243716d50e9165c39152f2a4aac3a9f23614472f2a4c85e5e7b48372e5548f60c71d079656d7b87e108ed52e0101df5303ab25ac38f758d69bbd693be410cdf05f6c657bee55c565ba39a44eb1422a09e3afaa7bf0016a4364dbf960aee1b45d70f20ead95646a813930dda4e5594df2daaae0daf96e418ec662eb48e46875b2dbb4b2f66557defcb0ac795e126a4b71ce596282d2d68a30763f515e23a90d3576c4c3a3be2fabcfecdedd34986441a91c6f1006c43ba475924994fc5f4c93f385a1d6406f5bab6bb1f0f29dd3139dfd5efe9d1ab52dea39abe67138a283bc1c7cea4914bb50ca190baa6ecc9342db0163687b053771ea61c0149a06fe876dc1815990bdd5b4b6c3ff921c709a81212421c32559dd453ce499900936a12c686d60d6a93be727bbae6130a9692f14f12a42b3f6a97c6979b58a996446d2a85ad52fd789a65409b05ab227835f1bb7a72bc7363abb557dc7bcc689ed8f7579ee56716eec34c5d583bbe26b1c498215b9a7861145dd09d9ffba16b4b7833a2f1e0f3c5f39cc3093d83bd2796191a351f4059e9156cfef7425358692434ac21842134a622ced287b0b5e798f764bcc696e3b25acad196eaf6fbac8cba50c8939d0536ccac98529a60b692d75546a39e7f59eb8a518ef4938fad28b3d74f7b73ee93f2310f35d89b7c9f3ce402545c55e4b9c817c2926ee949eb74478806f197a872819aed3246572108ea281d5cf9cfc85d7de2f99bcd51753a5ea610851057c5674aad3a9f2a53b1e206dd0777e7112429162341b5b5d1728e7715bb218df46e547ca465ed95412e93220ff17e218c984586ba1ff9bb0185eb0a61a8238f41b81cb62de1b395cbb31690fb92e98531f6c246ab89e16815bcb7b7075de019e017680c49da7aca4c2581038fbe2b895197211ba61fb72b3896a73e93ba545a261424362041d3515b4e9ef7f2ad0f48cfc1235c2e4de2cee82be602a62f0252d70c6ef3d344a428dc930a8eba6609a65d72caafe5d95b2e36b34c1cc18ce48c2af9ad1537b9b7e371825ab8ef49b9751f2b0a79885a3c62403e830232f9e48eed293c251552fd7469a548b9611ad28d36b13939729b5a75019e7b2c8377e351c30f00b89a47ff91870731596ed0eeb64a379a57337fe6f108f74ca16ef0919f22d3ebf7bbb58d6bc27203481d018455bba4848a0354b964b3e84a946cb060669869b05a20c5fc54066ec4e42c29b2cca153fb39e9837e88e89afcaf908ffdfb4bb8cdcfb03e4754e4cfa3cac19eefd268f3bb934bb4724161e77d2b9ad42b560fffea1f934185f7c73e42cab7c9ac10d599d19799cbf62a2ed61a0696caa466e6b428394af29a3f2724ea0cb46ac823ae7184cf07301542c8d73475da329aac973d668fa3819d656cba7073b2daa619ac6b53972aa3b8af26c5dbc3dc23f5dafa4160b19b572cc412f6251bfa96b5ab25d0db97f0e7e9e86b6451d474b2e3652a3be806e60bedf4d5b7315382c91a81d11dfa8a0a283b9220352fe431bd4b62a5dd29cc676858816da73330a3c24de784dc9c03ba4d2376b5aee64ad123f31cfe2e261f78359b1086bcd272b2c9aa2f2ef5e69353bb924dca41cc6bf5b1390991099ea97389add139cba0d9b608760f1f74cef11166f418c67246b886e32ce440bc7060f9384ab36ff50a8d1c18f6b8ee5485a43f8cfc867db248a473db59eec8f250fe794d60c1dd456715997f50d55da9fad4c32c5baffcdedcf16a9484a93b167eceaa82fa616749dbc43305bcec44b9580caf5aadd6fb14f9042e0735cd2ed0a173d8fef514fdc4bccd71ec6cc49c1e9d8ffe7d2615eff9f9cc4bfce98cb793c4aedb940fc57b75f30c3b7e5840d8f4ebcde0423924a721d4f2df6656457a7e323244c20cad157bee1f2eea336b8db057b226a4cb99bff1aa662988513a11c102b156b8c18d1bfd684865a3b129ce386798bad2ab9caf01e956ea951b6d3e2eae80db534d1a55fb9a3b3be36883402c61d129597bb6c8856c0ec948a798e20b6c89a69ed1b78bcaba63ba0b39e789c54774b5b29cfe9bb98a773e7c7e8e219faea56a3be103f4429675cd25a7fa41c42b3a82f7d5495cdaf5f7a5967a9b8e2b78ab130a803f7e9fa99e905a66ec9cf7aac9831cc35c48e57575985f5ccbeb2fd8ec4e345274143edfb0cddb170a66ff683b3fce2823ea18cb529815535278c458e88198bd4e39da05ad37131f98fe3c62cbdff1d7d79db0eacd3fd62af07e3e848e4f7da7a6de189586cc868002b0ce165cd5fd713272f03fca4223c42eaded61f2095368de90e50ca5fdde34760bec58f2983fa02df26dd2dcfa4908db64b63e4ea4a8c68054e0546b200416ec8b39b9b8a816e66e5085e0ccf887450d616af9c83a81dae95efcb610d116302c747f0e26d7ca14876572158c87ad273716afe5bfa950c322ba6e2c3d40e9acac8408320261fc89ab44c1ad8c26072e3904df6d9ec32fc90e14fdb3acff1ba59a0f5c1c8a11072247b1c5572f81bc3ea7a90d57a302cdd032525273918d8e174b1f70d418784abbcf275de3528b26c9e0fcb7fee188a0900669522e64d1e8ebb1fc73991b14dd48b92c16cc7042bbbc5aaf7c0b0c4dda523e2179741ed3fbc36fa9d74b33e9fd53a3bad71cc48e0254aed35242ee5acb116ff72fbeb0b6aee8604c4a7d6070306858d789b158a1e66aeb09cf9b3487a8051ca2e5790e5b528ae1d04f841e90decc6ea228d234d2774a916bbd6cfe7ab5c4fbe93ea40eb62cf3d3bdb91c1f6c061b9ada0962df98235141ee773165de99573084cdba7b2f38d6f56f7e489f9155ec7224a3c516d35c57ebdb32880d55ae17dfa7dffce96f8e8b6f6566b196f83ee69194800b7df4a7b488a57be6c228e3bead116c28113bbaa4c76df0810c559fcb6cecdccab10e0c1c39eace163e545a4db011bdd2b07732210aa428f180d95de9ede15e49d3fb4c8479dc751eac25951dc659d6b45ccaa9a8595159468e2911369b2497ee0d7d30c6ae9e82c399683b7168e19987ea9fa50cbbad3c8d82bd83effc87c28257c50a016125a433fef82e7ea232dd36e86cc17f68286c9a7a255e80a2cc8db3b8e48643081f54ded49c3784aa8638af9fbb527afb60811a42fbece737ec2808e7327b5aa0c11eab2573d5e4ab7fe7ae5fbecc995c2e4669caa47fc6499d56aab4c538143bacadccec4758d64152790fe61bea49e22594eb31243b1c676488abf571b59bedd95e2eec18d327448e4b90dd9425d42907b4a2bd8c3d6a241f27f9b0be62f1ba7752b02b5c18c285da181a0a9bbab8a0411dd0773bdd069271bf49f9b8a56b26ea12c7b5afa26cfdea950a49efa0e693d6f8ff30b347dcce8bb005351809505166a9fc485bf94389ee97287c9c947be61f729a3ce4240b98c6c5eb131169860972ab1e16224e8a584eb527543fb1bbfed4bebf48dc41e8abb8fe4d79a4281c2ee53478e854789da21c41ab87b3a8f5ecdf6b88c7d1f0da3e82a3fc3da10f004e4da370750d0c5bde66abd9bf961adba7ea3e7e1c55db2dbc35313f504629b8a32bc97af172a99b682f176506074f19e48b30cc5cca14c7796925aee15d667cb49f919266e6e93706a509966221648859a6f57e9bf2346e024ef12a2800e566c2a038198157e46eeff1daa328e995586038bff14180498ae729a02fed67f2a593d3c92b262652bdad716da9b9874315d18c9ba9bff39634017ef612fff1a3288c0fbcbb281372f5ee3bb4c240f0bcd0bd41e8b552e827653066b8493788b8cd65b435b0ee9632d41c569875634533732a31632bf7730c3b6cb6988822a0c32a9773f26ae5ddf90741816d5b18224c826e872bc2a1f98b13c1390a4e29b77a56946fa305f1034358bcd8098d9ce3aecaad8adb252df9fc09e3a1e9029ec9987b014c1e3d774ad37e60996b19ab11c692e10fc644a04ff34c67f6e2cf4a8c4a583939690568944ebe4eb118c56933d761dc36bad38e52cd20242fadf1c9dd7c044978521af270d7e0ede9fc50e9f59a4194090a03be001d2e0c469c8e6861fed1040e05ab399a578add6038864bd7b0d4cb28befb4f6243ba22351d631a6e2330ee30bb87c1931bdbc24c0ed3a724c6cc3041b27a47667e961515346581a3e177470ff113126aabad404980c3e4f141590f8285aceccc9dc446dca0922e09b1595d3df818db9ae00a2501c0e277c38757008f72221e2cb9c893f287a37321729de91784741e9b3d1501586287eabd326176060adfe9160edb1f81c41d9f0569b73c59a8f1487b84545798c93d424f84964fbf0b6619b8337f375ee7e4bdd42df4771587af9918ec9568a8a26983f2823738a4c231d6596f8d40f1ae5566783325af7fa62fe09baeac86cf086d87e3b923ef88f76e70ce9e93151e284c9712ad3d6d5e84fb75679b865d23aba296b77be35c35db62764e61d0f4030e19e3b15365735cbb25e23899495f2bcc80847ef77cd7e3af577af6011d29b37737d48c8a886d695a33d12cd46e87efb95d4f16fc42b0070133945cf592d7e0786d2ad697d52cd8adacd33f8a4a36b4855a19721e82e6f9e6b70c71cee1891b14bfd31bec1467bd4b9a369022a80348b5c89330f130dfd1cdd65d46006d7bb9a29910a38b9715abb7f9761bea2b32b8f72762d27993e8a085a06555b7f00bef21ebde067a1c09422af14313c07400a4baff0709569b7ca2d729a9242baecf73f7cb21fe4816a6dbaab43419b22c654a7f4a381543e1b08ba5d428dda4914d6fd2a7361f5fbb700ec56eb9444cfe2d8138d45e5da58e4c33a2244b69b4027c40f3f52fe010b51dc63a44f6c50db0820cc8774dbb13309b2d2f4977b059be790d1c955d018341f529fea1c851d6ee072504602d6ece1f91776c19", 0x1000, 0x8}], 0x80000, &(0x7f0000001600)={[{@umask={'umask', 0x3d, 0x20}}], [{@fowner_eq={'fowner', 0x3d, r1}}, {@dont_measure='dont_measure'}]}) r2 = socket(0x40000000015, 0x805, 0x0) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r2, 0x84, 0x10, &(0x7f0000001700)=@assoc_value={0x0, 0x8000}, &(0x7f0000001740)=0x8) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r2, 0x84, 0x72, &(0x7f0000000140)={r3, 0x7}, &(0x7f0000000180)=0x47) getsockopt$inet_sctp_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f00000001c0)={r4, 0x400, 0x8}, &(0x7f0000000200)=0x8) setsockopt$inet_group_source_req(r2, 0x0, 0x2f, &(0x7f0000000240)={0x200, {{0x2, 0x4e21, @rand_addr=0x21}}, {{0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}}}, 0x108) getsockopt(r2, 0x114, 0x2711, &(0x7f0000af0fe7)=""/13, &(0x7f000033bffc)=0x373) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000000)={0x6, 0xff, 0x200, 0xfc36, 0xfffffffffffff801, 0xc82d, 0x3, 0x61e, 0x0}, &(0x7f0000000080)=0x20) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f00000000c0)={r5, 0x6, 0xc30}, &(0x7f0000000100)=0x8) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f00000016c0)=0x810, 0x4) 12:46:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0xd4c3, &(0x7f00000004c0)="0adc1f123c123c3188b070eed5b90afd551be970673454263cd2e12bb5ec5bb78efbdb32695eccee531611e752515ff81b40d22af87c06258a6b23a65d7ef894bc98b0d7856bf6edcd46559fe07fd1a8d19aac3965700fe4dd41e5565ac3541b2df53c51abfaf22ed13b0300000000000000fef1fed3a9013f121ce20f0a19383a4460c591b7785461e68fba5437e916052f20faa177d8248a2fe7ab299432d039da6aeab2f807e6cd86ee11876404da319e00136a65b2aa5b11f392628796195c35b0e73ce177ef88cd9d0d31663c35bc878f") r1 = socket$netlink(0x10, 0x3, 0x4) r2 = syz_genetlink_get_family_id$tipc(&(0x7f0000000080)='TIPC\x00') sendmsg$TIPC_CMD_RESET_LINK_STATS(r1, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)={0x28, r2, 0x2, 0x70bd2d, 0x25dfdbff, {{}, 0x0, 0x410c, 0x0, {0xc, 0x14, 'syz0\x00'}}, ["", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4010}, 0x1) r3 = socket$inet6(0xa, 0x3, 0x2f) ioctl$PERF_EVENT_IOC_PERIOD(r0, 0x40082404, &(0x7f0000000000)=0x9119) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r4, r3, 0x0) 12:46:13 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x4000f6, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 364.800632][T29629] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 364.805211][T29637] binder: 29635:29637 ioctl c0306201 20000400 returned -14 12:46:13 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 364.858262][T29660] binder_alloc: binder_alloc_mmap_handler: 29635 20001000-20004000 already mapped failed -16 [ 364.882996][T29637] binder: BINDER_SET_CONTEXT_MGR already set [ 364.889259][T29660] binder_alloc: 29635: binder_alloc_buf, no vma 12:46:13 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400300, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:13 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x8000f, 0x6) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) [ 364.903480][T29637] binder: 29635:29637 ioctl 40046207 0 returned -16 [ 364.915151][T29660] binder: 29635:29660 transaction failed 29189/-3, size 0-0 line 3147 [ 364.929590][ T7669] binder: release 29635:29637 transaction 123 out, still active [ 364.938739][T29660] binder: 29635:29660 ioctl c0306201 20000400 returned -14 [ 364.947316][ T7669] binder: undelivered TRANSACTION_COMPLETE 12:46:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x7, 0x81) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x100000000000, 0xa}, {0x0, 0x0, 0x0, 0x2}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = dup3(r2, r1, 0x0) ioctl$VIDIOC_S_JPEGCOMP(r3, 0x408c563e, &(0x7f0000000000)={0x47, 0xc, 0x25, "fc1bb2d395a8e744d5fc2dab24f28aa29cdc3b9645fdb8128de2f4625f83ff701a976369c47bab0b273e13382a8a2f109d083e868064885ae9ce0648", 0x3, "e9dc6a367d9f201636b7dee6877ae59140eff6bf5e253c5116978e7eb7ec9ce98e5a5c21720c2fb1a15cfb8d5e9650101355fae3762848c420a6ed77", 0x10}) [ 364.989277][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 365.008117][T29722] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 365.022428][ T7669] binder: send failed reply for transaction 123, target dead 12:46:14 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:14 executing program 4: bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x2, 0x3, &(0x7f00000000c0)=@framed={{0xffffff85, 0x0, 0x0, 0x0, 0x7, 0x15}}, &(0x7f0000000000)='syzkaller\x00', 0x1, 0xcf, &(0x7f0000000340)=""/207}, 0x48) r0 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x9, 0x101002) connect$vsock_stream(r0, &(0x7f0000000080)={0x28, 0x0, 0x0, @my=0x0}, 0x10) 12:46:14 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0xc0189436, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x5450, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:14 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400500, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:14 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x3, 0x7ff, 0x7243}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0xfffffffffffffffd, @in=@loopback, 0x3505, 0x0, 0x0, 0x7}}, 0xe8) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ptmx\x00', 0xa03, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) 12:46:14 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:14 executing program 4: r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000280)='/dev/sequencer2\x00', 0x0, 0x0) fadvise64(r0, 0x0, 0x0, 0x5) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r0, 0x40085112, &(0x7f0000000100)={{0xffffff92}, {0xffffffc0}, 0x0, 0x0, 0x0, [], [0x0, 0x0, 0x0, 0xff03]}) [ 365.699184][T29889] binder: 29887:29889 ioctl c0306201 20000400 returned -14 [ 365.723296][T29895] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 365.735712][T29899] binder_alloc: binder_alloc_mmap_handler: 29887 20001000-20004000 already mapped failed -16 12:46:14 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 365.760594][T29899] binder: BINDER_SET_CONTEXT_MGR already set [ 365.766754][T29899] binder: 29887:29899 ioctl 40046207 0 returned -16 [ 365.771234][T29902] binder_alloc: 29887: binder_alloc_buf, no vma 12:46:14 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = dup3(r2, r1, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r3, 0x0, 0x3, &(0x7f0000000000), 0x4) 12:46:14 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400600, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 365.809242][T29902] binder: 29887:29902 transaction failed 29189/-3, size 0-0 line 3147 [ 365.818475][T29902] binder: 29887:29902 ioctl c0306201 20000400 returned -14 [ 365.827590][ T7669] binder: release 29887:29889 transaction 126 out, still active [ 365.841196][ T7669] binder: undelivered TRANSACTION_COMPLETE 12:46:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x5451, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:14 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x0, 0x2, &(0x7f0000000080)=@raw=[@map={0x18, 0x0, 0x1, 0x0, r1}], &(0x7f0000000140)='GPL\x00', 0xffffffffffffff82, 0xa0, &(0x7f0000000400)=""/160, 0x0, 0x1}, 0x48) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffff9c, 0x0, 0x11, &(0x7f00000013c0)={{{@in=@local, @in6=@mcast2}}, {{@in6=@local}, 0x0, @in=@multicast1}}, &(0x7f00000014c0)=0xe8) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f0000000000)) ioctl$UI_SET_RELBIT(0xffffffffffffffff, 0x40045566, 0x0) ftruncate(r1, 0xffff) add_key(&(0x7f0000000840)='.dead\x00', &(0x7f0000000880), &(0x7f0000000980), 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r1, 0x84, 0x6b, &(0x7f0000000700)=[@in={0x2, 0x4e20, @rand_addr=0x4}, @in6={0xa, 0x4e22, 0x20, @ipv4={[], [], @dev}, 0x6}, @in6={0xa, 0x4e23, 0x5, @local, 0x95}, @in={0x2, 0x4e23, @remote}, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0xf}}], 0x68) setsockopt$RDS_GET_MR_FOR_DEST(r1, 0x114, 0x7, &(0x7f0000000bc0)={@sco={0x1f, {0x7ff, 0x9, 0x5, 0x9, 0x8, 0xab7d}}, {&(0x7f0000000ac0)=""/228, 0xe4}, &(0x7f00000008c0), 0x6}, 0xa0) socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_emit_ethernet(0x6a, &(0x7f00000000c0)={@local, @broadcast, [], {@ipv4={0x800, {{0x5, 0x4, 0x0, 0x0, 0x5c, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x11}}, @icmp=@parameter_prob={0x5, 0x4, 0x0, 0x0, 0x0, 0x0, {0x10, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4001, 0x0, @local, @dev={0xac, 0x14, 0x14, 0x48}, {[@timestamp={0x8, 0x2c, 0x0, 0x0, 0x0, [{[@rand_addr]}, {[@multicast2]}, {[@multicast1]}, {}, {[@loopback]}, {}]}]}}}}}}}, &(0x7f0000000000)) r2 = getpid() capset(&(0x7f0000000200)={0x200f1526, r2}, &(0x7f00000002c0)={0x2, 0x5, 0xc3, 0x400, 0x0, 0x7}) ioctl$TIOCCBRK(r1, 0x5428) mknod(&(0x7f0000000a00)='./file0\x00', 0x461, 0x0) execve(&(0x7f0000000100)='./file0\x00', &(0x7f00000006c0), &(0x7f0000000640)=[&(0x7f0000000240)=']\x00']) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r0, 0xc0305602, &(0x7f0000000180)={0x0, 0x78, 0x2035}) lsetxattr$security_smack_entry(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000280)='security.SMACK64IPIN\x00', &(0x7f00000004c0)='keyring-)em0[vboxnet1security\x00', 0x1e, 0x1) [ 365.895958][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 365.923909][ T7669] binder: send failed reply for transaction 126, target dead [ 365.928406][T30015] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 365.983465][T30021] binder: 30020:30021 ioctl c0306201 20000400 returned -14 [ 366.015387][T30022] binder_alloc: binder_alloc_mmap_handler: 30020 20001000-20004000 already mapped failed -16 [ 366.048225][T30021] binder: BINDER_SET_CONTEXT_MGR already set [ 366.061978][T30021] binder: 30020:30021 ioctl 40046207 0 returned -16 [ 366.095504][ T7669] binder: release 30020:30021 transaction 129 out, still active [ 366.105993][T30022] binder_alloc: 30020: binder_alloc_buf, no vma [ 366.126196][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 366.137975][T30022] binder: 30020:30022 transaction failed 29189/-3, size 0-0 line 3147 [ 366.154602][ T7669] binder: send failed reply for transaction 129, target dead [ 366.161949][T30022] binder: 30020:30022 ioctl c0306201 20000400 returned -14 [ 366.172335][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 12:46:15 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0xc018aa3f, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:15 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:15 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = dup3(r2, r1, 0x0) getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000000)={0x0, 0x800, 0x30, 0x220, 0x1}, &(0x7f0000000040)=0x18) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0x6d, &(0x7f00000003c0)={r4, 0x1000, "085771d99871cf8af76e3232a201f51f90068cb84c328dc73c69abb06ed11de4df39318f8c488d591823c4ef86f761edf3fd1717b360117aee652cefec23a9ee5b6bb7dbb29083590d75756ee0dd495096525463a33093ade38341c40065e8f10550730be49799f2455e98a179e1382ba2f1993451eccfa2b1bdc7a9eaf51df25a444876c28b09149b8749a7245d339f7a624f1370d4ad658ca08f0446f6e2d68a3ed3e2a8c6f19440b9af2139d991144b12210a69aed09e2900571eedd02cf124a194661af3155884d791b39421224ec3735d887a511d3aefcb95b7ea6d03ea1032f18b2cdc814468c58c7308178e17a9eb4c1fe548b911b8e1a4f87ff6331fd6facb6ab3780e7d93c9a526e71436faa9476baa0322a0df2800adb9b2068950085f0dd41fc5823ae131cb22c249ca06c14a6fae2fad5fc310f70a4b696c88a1dde9bc753cf0b128117de3e3db880c3749b78c29e7e24225b50902d40531ee5da69135cb8becf5b454d0fb2a23482c100727ea37ab39f4bcf0343bb5679deb6850dc537bdea177a2e6667368bb9392ed7f9c7fb823ad73aa36706c32c78f61d7d2dcf98d68a380a518a9e628a15343f851e522256a856ec56f152cc7fc6a3a9dd1fd9eef2a6e0957be54fe481d2a6fa0c1dc5f4727d6ff0d5aeb10bcebd1d59999e721952209035d88b0c994a072929bbd16f801d6b883f5e47668a24b78f1145d9152df7c812acc82f1ca11f40228a7b8f3ad136f994f021af83619020aae9c966f5796b6d7fc970c2a332eff34faa92c50e60e68b3302b1481a43bc9951db926350bc6dd9ec9642d733103c677b4a079e53db1844969e46ace9f7d6eca0a158fbb91249bb76c3a93e83ba4d5fa507f64324982fd19b4321dff816afc402d0c4938b7768038930ce0b524c1adc98ade6568f307dcef1c660713565f8b6582ee5936773249a6078020abde4d0f11e0f729273f9dbefc5064295a6ee68e89444949c5f107bd0478b42408b6a5a93496dc8f6b32efdcfa10bb1486fde83e3b1cc9e4095321d330ea9a95a49334191e7150fbe8fb926acf6e8ffe18b40f8a82481cda91f8a0c7c74cc4af9397a17cdc8d3c277e9cbc8e4d2054ccd910b8e120f44d484d59c70685f2d3daacacca3b2458720ff4f8d1e7d312eb63a1e21d9b031f0adc1edb13eae9f898f0a0f4ad5257adc6a57255f00e97af8245d16bb0f9f9968a9b4450f02a92c6fcae10f58691a4c4b35cfb6594473b97953a40a1eeab5f4b59df7106694780539663e92243b4c647ee56b9e7e624e0fca303eb008e2e366a67c821dd30f78e172ee3eaf632e7979ccca6e6605f148ccbbc892280e37efe6e86895ef3cb8ab3b0a4352485912fba994c7133fc9c41b1c168e95fbe1e43959ce6b8e3e71091549df72188eeb97bd1289b6664c276cf46db200a02d65ac47af5442cf5766335eb748739e5415663ce7a9902fdb66325368dbcdadb5b940bb67a5e3ac56ec72a97a5dea8ca222ee251c1b52aa794819d05934cbfea68979c10bef259318a1adaea319a9b2c36828f2d9fdd20d41fb2cb6edfdc0e58434026446c0a58f752d2723963317410e360b322a14f7e4858c0897995e1f4e429f89140405b23b4911c6c43d3a3bf6d6fa122a50978a9c67f6e1c78ab67170724ebd9d1806d24617fc584ed44291734eec705e2d7e44d06d36179607282fd836765fcf2ad2c87370afb1780c65fa4c5c756decf7dd2b8d3e0f0e53ee5cea4b68e81d15cc6e38528a97dd5d4bea11e0d216be7cd73024eabeac300adbaa40a77e7791efdbf82d2de960b1dd6c7fbcce84fe66ba4721f6b6c923560864f9de1a7cbcfdfa717c45ff40473689deab1c4908105c9a1920ac96cb54ac13a52b965a6b26169ff1ba6bf7ec968b288a029f1521f81b60e60b9db55c4f4e9487a2fb3503cc104d84a7a6e1974e67a18338f70a6fabf1cb3819389f4b3e120928d300b84c8c581a770e99cd8105e467c4c6f8da0af641deab24f501b8579f07e2e3645a18b0aa542afe59685d96a5815109c080cb47743869826e07a528e5c34708afb82e5e8c09b6d73289ef6fdf4405c2192f30af909c1a50a27eccb5237ae1600a046b372b62a295c43be3c287038d449b7c6f94248184b1d9d6c0fcd5dd178c28c1e9b50a252353c242cdce15117db9e8f01a9cf11bbca6568323daa97e893511e4dcbcee4da2afc7d5e381de9102b84c26639fb8a79f489f75b9145252906d41182afc49a66884bedb07c469e5e31734253602e32929a810a81f498ae8ea9aa2bc8ace4fcac528daf52b9fadf5ecfb414f4a69f8f7f714c77257d9a1c07d40d6acb3a05769712bb59f7bcde78c57136fa2eb2aa16425c9b913159ae64dac90c5af5384c75dbdc0c81da3560632119ca637b231b38451fd0bab537a4d838f11ff54b4cdabcaf91f11e334cc4c7c066e49adee2990b62eaebbc815e807789215105bceb9b3a4a1cc8beb80938960a52d56d0fe8d618c0a2d222c32d59a01ca0ec50dcb2d314c9856f7f1c3194bba2fa8ff77be5a13279368342f78e5542c49ad821f666a6c1bee7519c732e542b5e483816e6a4aa9e61ace3cf5e4f1d5bcfded03b51e70a57515d79b1a1d9661ae3cb24e133ee96920e68d7f7d7747cf459033beb2acd7e2cf2146d5fa18d126f758a76927bae18886fcbbdfa418719802ffcb15ce0c48647a743d0417b98e53707b9999debd104a708a1db270e427e18cb7fd6dcad8f1caa31e81b195a990c360403ba5e7a77ef5ad694b76145ce1fa9de51cc1b9f3c28f382bf8eea2f9cb2bd0bc761c6ef0b698d3d431ae5d2146d5754f0726862a363417b4b87c3ccdfa5fcc4f9aff1b5200885ec9a6ce44431f9b6c5419776f91a8d18c8a53858fc2e866eb1b9a8f80554f55aadef66ead2ab8ec92b2cf511dd64a63da0ec5f2139f582969ee52ccb2bf06f6767c90f3e68c56503415ee87eca595ad4c7bef0a20b86c0563018969635943023a36efae5c16f363792a558437d8390e8c74a8c03d3b9c694cff8923c95f9df3af6577da09d4b25fa02c6a9c35e4a92f2b36b491c325f7029acb4be1795db4e003c303b2cd2c1be0e3edbcb1b4cb06b6a2f548e8ca455e0dd4a3fc12a3cdcc2af44b2f39d0ef3489ae0ae2f820b5e749bac6344091a3fad7e799366c1c23fcca765cf36b367c9b9ba9119322d01f58100a0f89c12a2b08c32c88beaa01b0dbaa69d16ddb81d7a447fc5d054a52a0296e362f91b4619a4951ad090a413991452d2389860ee90a106bf5fd1aff445df10a4eb9e0d993696724e2f10c7d4f4766f08278ba9e080b96d0cb7efebe9b7c72ab9833087c847a05c6f5517ccf766a0711a769ae1b4d06527dcf61d68734808a8f9a913ed1717552bd932229cd3281eb60a1f4a8d839129fb8b2ea81989a23bbb9e2248f4f0cef17783423add8f6808e8f49f973aa76c50ba3f077cef0fffa0339f5db5e2dc0639dba1da62bdff0ae34279d2074b660121493ae0862aebf7bb08b4c4b212942a2062be245641aa3123e7e3676a5d869133c0dd7a2aef4785498774eb3611b24c4c00c1732ab71efe059c8aa17b20ab5420c958b19e67983038b7eb8eb92f38522ab14982802ece1c1a5d6c78195a6115394e746c9cac4450c107d492c7828f8a425e1286c0989fffae6d4de70584dfada3eec73ea2782a7758b7eb54af4f75c025b5310667e1a109bf4c1753f014cbf9405721b1ec8dc611f4b939c0aef2dee257d3d8969f156dc73e6256e90ffdc0c2a51f560628347938cf5b56f77e6bc67914bf9a715b74457912a2236731865cb633f4b9e22bb9a7e9c3ddafb38f39462d2ca6eb579e1324a430c4d60e589aa34b3d706e4732a53a829bcc09c45e0b1e20c7b5183273c3bfe5d7f5ff0b4152afe04f1a6585cd1aa0f5c4169b4fb08790e5025d6c9139418522d449c3a42662e3730a5b3e9d3f4604ce696fccde3008c50034fd139773c8a474f3e7fc9e82573e2b9ac492f8b2033a2d91b609cfbc2375a0c3b7c707d35e6e841c696ca4c87ae95844fcf02bb8ed999481af0d46841726903ad6b6522943943731fe550231676df004a47b025a0c0ca3a0a2ae106f372e708f5b27b1550027da64c7f2d2209c827fe91633aa45945b4dd8e24df4f6a8335635f34e66cdfc28f0a7d783e2a05eec80e62177895c442b0ca4cc2653eff9cdfd12a349d0af231f475add534a954409ab54099d08c0115c2c4c296ee9fc70b1f97616a390e306ce5939a5eb5452e29c471c52e4c14cfc66fba1751847ff3120a158d35d9f625d82a9ddb9b5328a57f3e0a04265e9804841265674a7788702691c4fac35a15a3e50e710e342d3299609e6496fdd9ac15fc0607da7acaeb116815e8e58e9e83a5c345d14741d742d42b5a961a031f1f71ae4b80c9055a2b57ac7365905701ae2d6ec9f300b5089672f6c4659928854bac173cdef1d8d0f3169ba97a24d27fb31282926010c1bc86bd04c67bf03c8c45d9a50e9e13959b954b027c5defb9df342e4940abb26ca5378d656d745fc32f1dff77481a7932b3232161f11351827de6bfe4eeb59bc201668bbf30e543455365e75351401949e023c7326607f2d9f3d1e2ed89a8fa3127de6bc325718cd1ccbc45d3e9eb58f9d69c0185cb107b6c33f369176789dc4dd4acd5ce7549511b588580a4646868d6c456bd0851f868b9a03fca4ec71ea2c8200132b4ea68dbdf3684795c0ebb31aa7a0de48b6d19b62a1505d814597567db3ed0060f6d179f3ddb703da52f974afc3cefbbe27b706ce316a337d3db801cf357b0599eed29297a2af60e6a5550ffce980922c30a1436d29fb1d5f3667b5ebbc10666f95545c3446d9ff6b56badc0adcd7ece171101f860b9b22cc1e6c534edd21343e086bc1ce2755e1dc7915b9c96c4f6b9f6690adfb4f5c34742fa680fd955d9a9f0624b6b11b81ea77a2ee8e08cd8f4d962c83697ce5ab37854f99dbf366bf9fbff20f77b2d8e5d17a7cb07ddc9709261a13674b6734e9c7ed4de67538723ec8ac9842d27e402084629e1b45c318cc449b59faf8dfe264ac7851a124dad70189757cda2823945a1458d1399b58167f70c525c5bc314ed76e16eefa919e6efa837b90d2248023ed4dc37ce60d6ec4b31f21014ea4d693401586842fb229e14e25ee9ec7f96cb7b2b375a3932da948bc7e6eb63d7ec839fceeb1ceb63951d013179c1279102107eb5bddbfb40e619a6d26e8ce24ad461d803633c96a2ffa7f0a1aa18ad2b0517802b506842afda8f0939cfb75617032e80a2cce7ba9200953d37fd7e5bf233650091da8411ec30e0cc7c75437a972deac4caa139ea3fba9d139609afeeb8632404345876f31d234adbb6fc684d10b14a61aca658438d6483010e07cf258647d5914e13b6ef579a16ba454e7bece5bf95cab1ed34df8d765d9808737a9ae2e4d1640d9e18c5335c2dc1475b0d5fc08c860b389edf260ddaed6fd3ba31c3d92d9fc1234acb4a3892f082e13df2c9789e7c05a7fc33b1aabeab8921007769760595fec4a5ccc0bbc1f6f4d1fab0e2553936fb357a0e68ec0b0aa5ce7cc1443fa71308192af9d81d0e0f2ae5bce6daedbb172646da0751531c24f9bcd1dba47188bfe205a882c3d1af3c87ac8425991a1e2bcac7ff3bf86fa3223f62c8ace08f913e249f1d1238aa60a8ae5ffaf78292c4d326d68540ff70a7f1e73375ca994ddb8b8abb700ce7baed781be1ad1aa1d7292cd631064f4c27fb056e1f97832469f326a88f7437b3d0143979baf46"}, &(0x7f0000000080)=0x1008) ioctl$VIDIOC_G_EXT_CTRLS(r3, 0xc0205647, &(0x7f0000000140)={0xa30000, 0x100000000, 0x100000000, [], &(0x7f0000000100)={0x990bfd, 0x4, [], @value=0xfffffffffffffff9}}) 12:46:15 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400700, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:15 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000002c0)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) accept4$vsock_stream(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000100)={0x0, 0x100000}) accept4$packet(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = add_key$keyring(&(0x7f0000000140)='keyring\x00', &(0x7f0000000180)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffff8) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/ubi_ctrl\x00', 0x4000, 0x0) ioctl$RTC_SET_TIME(r4, 0x4024700a, &(0x7f0000000200)={0x2a, 0x15, 0xc, 0xc, 0x8, 0x2, 0x7fffffff, 0x120, 0xffffffffffffffff}) request_key(&(0x7f0000000000)='logon\x00', &(0x7f0000000080)={'syz', 0x3}, &(0x7f00000000c0)='/dev/kvm\x00', r3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) syz_open_dev$audion(0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000028000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 12:46:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x5452, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 366.589127][T30035] binder: 30034:30035 ioctl c0306201 20000400 returned -14 [ 366.621466][T30046] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:15 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:15 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400900, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 366.648324][T30049] binder_alloc: binder_alloc_mmap_handler: 30034 20001000-20004000 already mapped failed -16 12:46:15 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = open(&(0x7f0000000000)='./file0\x00', 0x2000, 0xa0) getsockopt$inet_mreqn(r2, 0x0, 0x27, &(0x7f0000000180)={@empty, @empty, 0x0}, &(0x7f00000001c0)=0xc) sendmmsg(r1, &(0x7f00000031c0)=[{{&(0x7f0000000200)=@can={0x1d, r3}, 0x80, &(0x7f00000017c0)=[{&(0x7f0000000700)="b442c12f5616fd8ace746a45adecc2722feb2681322c1110e80b349ed39bb938fd174bcd1330cb5244f84706c62bcdedf0d6d90ac473bd29ef740b66b7955d4e54631adf115fcd11a35bebdc6efab8fc9126b24075a3f09dcdc9a1fc699639fe32bb634a40e7b3bf4416186039623365a7af3695d0667ccbe5b8809fe0b6c22ee4865968ef91a96221426127b79a135a4d966ceb3833a170913131af9cf3b17f1ab4f72b26287ed43732469b6a237479bc842535b27f34f660388aefc61335c977e84147d08db1e314f64f0969aa4a215418cb993a636d8f09a65d6c920e76efa1a01890b2b579a294aeac7fe14d62169fa3ba56f236b3fe2e25f70d6785ea97465b268a060799a6e73bfcdd5ef9012295e6affeb8dd8b30f19a2de7ddc25c365ca4eafdca92c6889c46f2a1aabfabc2e944b4266ceaa0457907b648ba68ab662e4914a7303ee3adeaf4afc9fe5ec31d8c8d43c220ccc1e35d3c3cc4f70172c4ba1717f0e81f82a9d31307cc947d0c6319bcdff1b0b1645f3618cd743267cbad623b5508d0e72c688b183789b1070107f01eab74dafbb4ad7303786cff32c13c96602a737c305b0fa2a305447e05967b78f4b1ec027793f273102f12785cde8768fd3d753fe75ebca05b5c497c2ac81626e1020c95b6aa76f10feac4c1019223086c73a87895565d7b4deb1248dccfdd4ad8704ecd2eb4e187db1d585ba9cc718467cfa110deef7ca41f106542c385c70d468bf28350a112fc7f2f7f107536630677dcd43770cd02d2cfaaa371db74ca9a2cae09cdd58ee636718dc891c3d5974c8163801b2dcea1911513bee8068bd32e90e12deb7fa3f430d9f88947bdef77604ebd9ad81d568f58c782eab1b973a1b0e099491cf92f6ab507b1da674eb5097a6589f2227c04a9577e1f93a0ff54bc833b461a7b8d111cdd967fee1e0f55566a0afdbdd3a80c57095edfe767b72e536349a0a0176dcd28d8449f6edbb703c836db3ef2d3b537d8098c706974abc286369f920ddbbcb2447521fb3cff3e58ad9c8049f19e3f19ccb85236a15ed45be0ba7458abdb1a05e78eadfc8706f95cea92420497764b02eb14ce76887cd02389f6aa9d812145d550b42f0fd679788cfcb04e8e5c803533b6084c8898295b968a7bd1101637a500d7a9303b3cb2e7ca166bb2bd60be46782395e2f06e16f4d9743a06d855b7ce2cfcc688237a43d29dd22f551ae73485268b302cb7578248df845e104c7677644e472a85af5fac0ef0d0469ade63dce381ccb1a8a85c9a13109f4e2f8cf6ddc2c27db00ec7dafc4b65830598e377585f3bfb108c607e4de12ce2e3aecc1e89948c6a944623d7e8d97ce96a7a3989bf9916a13cdf1133ece71b1d8515cdefa337156ef0d600a3d03f5824c28ca762f508253e5cacaaac43014648cc48f424ed52ed8ccf31bf36d42010f241e4e8d4dc3629a88b93f27a8d9c74d4de432e060e093e76fc44e0eee55a578c863320dc69800275ab10798b00428eb3ddb35b24122bac24c5f2104a9abb7f9ff7ee7988ab8d027c249443831981c514efdb018a8e732800feb33b4b18e2655edb0aa8e934a74ad01cd6ee663dc89aaa19ba479e37d597220a5fabc8ccb8abe5fb3ae484e645662116d429203a21d88bfcf5a4ab396bcab83d3e703a1f6fab5d21b1b0a723ab635493c4ccafe0871f9413e6c5cff6fb546cd50915a73b3c598d30a148a53ce023e4321630d5915c7b2dca04c45682ef04cca9edba7982a2f196830f08ef6ca7e06cec0f6aa0a225fbdc6008a723f0062402d4dc9bc9bb9957b052ca05c7cdfaa9f6eaaf1826ee0273733ce184ff42aa5f01ec2a02cd329165aaaf1d3601bc46e147036dad549aa7e18e2c1941fb991cc47796a74d78ca59f02a3427a5f9632bf76476fc946f1ef69c3913509a54a2b1759129201c497d756b5756f47377d6915e3cce743bb81b3b6c5b09788cca2e09f8ff002bad68decac44bf9a716c8d46a8c9f6e93f8d423634326b70b511c2ae71d10515211db080538443eb95563f1b18e609a2dad862ef9e3e663f90768754fa82addb63e0f817e594ee92ecefa541d8784988d6098ef1bc1b79d7d17c0098a284e6ae276dce3812cc2c8a867a03a04bbb674524a558d924140c60f05e5b22e25917ab4e966eb08a80175447f00832c02348f345ae8aae87b3b5e1fe88f5c5a643e3c0e8600006aebdeee756b4498584c9be1fe5eeeb54eaeebc07c0cda38d1b4d21e03107e94f3cba31bd37b3603be5a21244054917a11a1bc72284c924b50b8c7963632688f2fe9dd1dfb24778bcb5900241b9baae6f24a4a9b84fa818114085b81ae63201373c8f28e2955f64b317fa31079b7aeaa6c7ea2fe55cc29f3808e51927edd9390a3023b153194fdaa2d6341a594d62a5dcd1927203f43e4d619b18d13d679c5699458bff00ce23c0fc020c400cc1c7cd81c29720931cd05d0ec3f91e444552d519a01bcf28202fe0670ac3f229303b0febc0c28b76c53a10b05bcf8f4e48c6ac438ef62f276b629911583b9554663caee0a9cbbe83a1376fbd798d73da4dc96250476acdca7c4246f803f97546ce3175d7b98b5e2b2cced339c25f5899b77e090a6e432fac96c7881193ea1e188a4b2a390cf2cacc2f76c3c28c12ffdbf090f2bd2c1f48678f0198cf546a276ae5d216b02a325bfa2fa6622ebcd462b26e9ce3b4b9cfa67d186b7c7625c0bc82e03fec7f402f40bcf25ef1210a8154b5ef281089a97b2c9a34e2f55ebe5054e27edfc892cdc168bb08636ae20be8d61c2de54a0c925701b93b61a75355680024f8e9501d5ef61387dd7114607bf20efae34fa469c67221a1ff9a1705c8cae25dd19799194c1b9c8439f2de52380fd91336f0bb636004ae10dcf44529a655726a26bbb63a81e535cf9de2c79393f606f9456e548475985eab6356894825c31659e3dcbb1e6bb1429f468cdaf97cea979cb49c698893d605d4a5306f2ee529947d3f00473d2e7aa4100af1ea7a7abb855cbee90bb4b9244702bc27a993e5c506457a8b4f8a60e20146f074c73f13483b1fdaf5d8c56e0929a2ae693bf6e87ae448a159e1cea365d7674abbf887c347a0ed8ac98f193971dc8870529ae6c31cc569fef6c93aa560adb15369a800db27c3c81907d2c720afa11b02812020721e3a9fd6cc446eb13c0f51614372f7d90d72f656fa109cac77e8b8d732242c5abd09aa65dde66c53f6577e649ec22ffae1f2d0370a91d94d0d7ea5d404a5a48642692685eccd9cf5d218a25f1a65e0427792da067d44fbc670f603e36eeec9afd402c8b102e0171ba62b6b7bb0555d3144076bbcb8e66b3a3ad962cf36e3d5bd6f13c7d7b4783a5b1f4cdb0eb5e0bafe7477ed43eb53d6235d921f82a40342b6001ffb895dc9b57077a7f84a2be5132169af540edcdb96e53ebc8d89477cdb38889ef94140cd9240bc34466181a30e464104abc6ba545011c3127e3ed2dd9c71d1602b38b4f28c0c043e0bff442516f9c2e8b60af1a3e549edd82cc2fc290c7b0292a99a2fb7fd097c99d0c174afdcf4d4d0a92cca80fe3e57b927bcddc9a8b895805326337960bbed34eb07c8633eadbf72e8c286578fd770809c6169fd80805fc471b00f9d6faaa5b877094ee6a19d6c6e870bcff95ff4079b4404067dbb48429c8bc3569a93f1da08d37507cf6acbaedef608657cb6894d582b0592c61e1823a1e8f355c23276c6cf03659d891be596825ac88317e84f093019df53ef970060de9e990a15d5cb691d20025a379748cd096569dde24f4dcf130b4ec3641ae637b38320b9fb374827cdf30a6430f9b5c0254385bad961685690d986d0a09837eace43bc1de782cac5e32d60295d5848073e2f043469bba05306fa23a8e81aec000863315a7c14c75b34d8a19a3b4c44a6126daf72e52606232f484a0d6b9847e91d71f30e99346405cef3e3a5559cf069831b2cb55cb2e28875b54da2af264b732961ef8bb0fcf08531e3f6197ac8a84417ed7982d6ce1f4bc0baf8296f68bfd7fc4553402eaa9bf368fc9786fe56c8cb38f385e3e3371bea92d005a9241a27d54944d3fed1c0ace0cbccb9d7b2b1001b03d8e3952f0f3fe57c93180b321f6e4ebd083786201dca57ab9f343544220ea34ae51bde05dc56b16d008ef123d77b5b85ca7859f50df5793a8ecba410a56eed93703c17153562219a9d29ee49fe58d997fd080df53480b5219f8f678b9f0cbfc8022f1fe41ad05ce575c1636c035867f2b77cddf9da23584b412618cc09748b5407401ce1614373d8ce101e6563d4d3af63be7d0535e23a7990c9ed1bb1d95c84e42c576eab078683fdc6c141c76e5084bbc02f3158b7209474f962b9a8e93439345393710aead8a1f4e02f25e5db4afdb20d318fd04aa92c922f9806643d8071190fe44e6cf2452b15ca613fb6ec492e6f36ff44af2450c5aaa878d7d1d99ace1bdb2b8eb9413d8d3d26a7584300c48cb3d88104c9b4e86c75d20eacdf7bdcd5c8d830e61425559bbf95b1f08c749b2f1e3ba671f7b65f94e2085e5bff864a419e2fe5008e4b4d94301181c238d900c696c60e499c0c3134f02ab30a2f84eb2450802fe6344dc0def0f36f0e9c0feb5e511c44f5af73fd8ce7cff90ab4c051cd6c956f1d37a936539a149a33a241380e84b14b4439991176d32251082b33fa27352e97de7d8c730400617a75439c97a040f203ea2970eaa3e417141989ce9c7f98f029dae1bbbe1ab81dd17d95a8f1a77a8edfb848661fa1438f1b7b7a9bfdb89d34f267860379e1669f9b205e4d5b0274279918b272c1390ecb2ffe20106f644b1483a227379a06034d57af2344f2fcbd979c287f3e83218356a17ff09718a20646bf5f141575a354af31676ca76812290906db82178e4223469408b957bd9ea4f22eed8dd2593faa8b3c6883c4df8f259cf1b5bd7f170a5e07d432c243dcd9ba2be50d897178c44d0b6cd2787e41f36be6b04da08be950033637910d3f4ac07a3f12214c60e0fe1bd8e3d08600561c35b69a6d12a0d3c51f4e353f928fe4a84a9bd670b65b23aea0c17c4f60f4cbf72f3313cc5f22ae129377ed19820364a9df50e61eba8656506557832771f1c153fc76ea040e4a070f40d0d9eaf2210cf8e7877030fbcc4eddc161e48f405e4b51671a3a2849b08d0abb43ab5d09aad23f2edb86341038f6beffd00cf75c80a52b246a55dc5957cc0f0f7606f098578e27504118970357d07801b27c975b4b84dabf47c69f99cd3207d2fca5a594fd2881120d5763ddc742a41c84765af502762cc5a446ce01dea7f3e813631e321e92eb6a411bab06fafc44310550274396c090b24b20aeb271ddeea64ba83c4e45441acb9cdcc4630627a8f5c526c405a85e590c10a109e7abf5c3066a34d366c051f44c2ac718a8504513e691007e18a3567b6e58e5628ce78023d953dbabd45c192c774f29480a1ff1af16027689197d51b5b614469592a8034e206e6237e7d3cf3de95b8411ad449d9123db047c2c2a3f81ba32dba9ca1d431200127a1fb33a7570700ee8a7b4ccc48d7c25c8fee9915b133132b5afb4faecdad613e996c5f9004e1b5e4547981772841ce0f39ca989fef8a62ff9610d22f923f72d2df72348f4220fa1af4c9303ae98a76e2cf3e2ffff9ca8ab1609d6af00517f3c72a67b6466b13149467df59be4bb413fb28653251b4082f6798ad98a2c8f9ad28550be6c48d6e7619a34c43825328dd7b314e3b6577d23d2785eebf1584aff89dde01bb337035b2b0e2eec30eb9", 0x1000}, {&(0x7f0000000280)}, {&(0x7f0000001700)="65f77814de08487cf6a932bcad3c2b1e57d109753567ee3f5bbdd2f3636441a264f7503278cd9c3f37004d54d9373b8644dcbf4c84592f673a61f17044ee8484df004f473b8a6c28109bcef691aa70c00d27a2d80a381f4fdbbe3e38c51eb048f2194b393cb47da52df57f5693f4b025e4b2a74175170261b5b4232693b6b98974cfcb4f", 0x84}], 0x3, &(0x7f0000001800)=[{0x1010, 0x13b, 0x60, "52d4c00ca95ebac6e457eaa5b3c49d9f90d201e59dc42bb269eb53f2e782eef2642dd6e00218c33df27108f9b2b9725afc5b1aaf42158304addd15c6b81ab9d8cd2b9f22e421769d09c4336f81eadf12401f63ff82f238d48020c37697a7b3656162e9564df75d4c2e281effca791f9000d8434c3b3b15104c73b21c9c89cf8e78f8403aba88bf2175982863f5bc80218e0c1e45228d77274896e311b01effbffdfebac65ca0c11a92c16cd49ec95d22d4efc36ac894be7a5b89a323c2fbb9c60f717a4f05defd7234a627c30d312f3307985218547bf2836471daba8e3dcdbd567cc01e55a7be258c85413f14ecaace41839597bb09491233f57c5365849170f882f305a8e6962f81ffd382d194bc02b02706e10dd0ffb5fa8baef2a5a24f18eb5c1bd8a8fa541a4c7e9d860512dde94212fa834141b22f9c8276e9ae960eebdc73835b7d524e4d9c4dcda028b8b0c9aafdbedf94b600e9d29906536a9cdfa9437a08ed7565c2760480198e00490851cf5167014a1521c503759431135fe1fee9bf24f85f36647b439e27bb4b03227d261ac13ae8e2deca07392596da0e60cc65106047239dbec563ad0db54fd8a3ee7e128369bff97ec2d6c531a2874eac4ce6e2a9c84ef5bf48ffc1801b38a1040242061bac0cb21a28908c77313942981e726256240cb7e03425c9692bed060a6afd8d7d0e732fdef9abd062008c9845da367be5860800f7cd9613f5cb9ba10efe99091dc1fb3a9007ef8f27755bdbcddc518ce54419d3efb0feeda5f92be257ccbe19529b2e3cee043f303145c77b29e04af8c71daad4f76bb81152423903bb4704cfdeb9abea11aa28047b34a28ec8039d6b09673e4f7de540bc3eba18073b6f7c4460a6b2a1172b6257730110ee3c6c7ea531691a0d5213360b6e46eb86badd5a036e660de23a11585965e0d504dbf0a8c63da55c5f7fe88e3ba9a780ba21a0ebc80fe23a5b723fe52724a55d033d04516868d1611d46adebf4c5fc1ba6dfad242a2ee40464060cbcb1dd1ca5072f7cfa8341d535cbd490c1b8f06deeb964272b90a878b283df29ca09da1a49ecc50769b754d9ae354970bb18a401c9e9bb19c9fae6ad1bc67b53573937b7c754681e6f1358229ff8acc4ad175234a68b0fd475a4a53ac00b565321d8a73336f9a0ad497e38a742ec617a8a816f4531724a6b63df908327f3e62b603564b7c7ca74b3c9f7d4879f411993aafb864cc95e90792aa44c17383d057870efafe45c672027cc971c09a007bb63aa00de7913eed87f7f792973abcc3def96adf51cddf9719651dd5febb95c30d75f26f98d9986cd86ed67a6d25c5c495181958f14436064641bf4b68547fcd176c0ffb524ee65540d56b869b3e682e249227f25d95bfda5c86c49228e1b68df49abe36d2820c7845697bcbd29b71396dbcae74fca7b4e85c9388bd8cb15714842d6d8be2af2ecdb441aec2114d32df71f36edba2c507635a1fb73c335a2da0f7a14d8556f58cb57ab258ac065d4ba213d5125498c773faa8137cbc9b2f2a1407c1c8b04943a41639d3bc68dacd721e60d4bed81fbde764c80e6496698831fc17d3e55010058d6c80dbde6b8d0c130490922d170e228963be20510e865ea28ed036516e8dac7b333de411e334a458f0cfb94dc45a5f43dce23774697d347a237f600e8f02e209840756630970bd6ca0758dbda5a9b1c61896bf1f7cee421d9418a0ebf4fa71b7fd0e0a87b9b69265f2834ce3300c5132ad1d3b2882283c13996195591c6115f15daffccdaaf2f71557a38a210c4432dfbb72d1dd4611a8937fb2517748fcf859cef7192486e122687b12d69fb7d1b2d30f12cac83be833219dbe313fbe9d6d22f235acb2a58c799a8e7cb2bf1f5fb768848512e6660f531a94be3f641923745db66d512df437b35d1ca0a85f7a54d810049cc55909f3be12092a126efef4be59990167bcdf6815ffe7219b7750dc855c0f53820160858c86ef4f6207505176e376bb086ab4aa971417b0fdb0d491fd367617c5d79c67537a60a967c032176173fa8320308c9bec72ecd982b659fb8f9944c0a6d3bb7364cef5eb153622724faaddab30f3e0e07222652b279bda4ac0e3ca69c78c4853c70e2c3d334acac13b3ecaa504ddbfbcd50fe282dc74aada40bd0ac2bdd2cc6698ca12cd95e9b9e5dc9fa82a594c3a6bd77d2887cbaa688d230e9000a6649cdb60ef8fe712c1f1f6c81823d48e51536a4051563fd6339d545d377f88fa3eeb8733078f292af991a15c2fbdfdf0dec901708c78516ca450b0e86cba59f61eaaa58ed7d14a1e34421983a5d4463b976a47369d93fc88fe01c40c11a3b8c893e02995c6f7886f10de56693ac6b1ac3e07bdd12eaab451b69017c5719b9a27b4f5d3c4bb1bd989be0a2846137049c42ea259d961db45584fdffffed64bf8f7b6aa14cdd89ab0bed2d65f88ec1a109f0260b796696f88082c44450bb358fe0c3f8a3f92f102ab7c962976b5f411be7bbab0ecacb7ddd57af7a51a051820f2197e4af437087f52915b779ce3c4c46135b74379c3493fa07b4b937babe5266749d63a8c897b95d963c0a4da45200caa88601b2f415362dcca52ce433965256f0d10899f7dd9c2eb88f294a345bae77c569531d29c8aab095a273dc47117a29fcb36f061a4e03ec9c8a591590aa753c38e7cffdd1e09eab7e9c605f4fc92b89f0e677f9d78c44bc53c478b7ee6fe47506b6e1069c41443ba478e6085beedbfe9a8123d5ac865ecda186ada14658beeecb81bfcb930e15bc4390412d2484aa03592de22607bd28bfda457349e4997e7a3b5d72eb004a50a26381fbf5bbb983fac11ff97ed3e75b8c19f587dcb38726e5168c0ea2153aab2006c512826bd2c0be796181214571d6135a5ad0f169dffab4132a60a377723d20218eb56f72628956b34e13aa848c92444d69dcdd3167980676b2ac6acaefe96bd654e0b65be0f99d426d0b3d23d6d80962785140982041a3a3cccdd6e9f606c9f6023ccd560507da54f230bdaacbf5840f3141d1a6429320bdc05a2c7decd780a742122c457aab7fa281b4850bcade0fd79dbccce1d106746f061d1cffecef42208c99bd8a66687318f46f55361434d7eb3d92fbcb57cdbb0c86123ade730c7497e792bb2712fd5d4fb62c18b81022b69f87b1da6781c80ebdd0d2558fe0fdf14ebb61b30affd40a0479600b4870c3d6947066618967259ebda29ad791be93a1a783f60333cc41c86166e94bedc7f843bbe66896e3a2d75d0163871eb863252c97585ad0dece9f89307dcbad81001e490d4ef4adfe34039246da598d111a8412c712ae2c9866f779ca6f55a59adb19a13439eb4c169dfbe158ee7cd509a0b42fb9dcc9f2911b30633b887b114671ec2fdfae7c0a0aa24b1b36c829ccf13dc5fd39c868fb8ff8a807bd216822c4364a6ebcb28fb67e45445405a434a99a42f8aab50482ef633428f645779f15fa9c1ba8d149d7ce1838dd2edd6c12991de0c5c97a5f1ad90d4580c96e7b8d2c89e260a8fef1fc23669c4e36441fb3fef857bca15300e701a3930bb8f435caa9e2d49d50b6c7725023ee74dac0e67ffc4c8cac674e7a78c24f6565bf20e178475eef8b352855243d5bf2bb0d4a20327d5903833bd3fd138c1b8da6318ae48a8edce12300710ba13e6a5c48dbe7a269ccf8d1a381cb0843af67822ec5b240582d756ca79e084fee62b4bf4c0d05d8116be045fb1f6747bb571fd75b7542d910c247dfb40e8a89cd33d28cd0438d9c2bf28384910dbe941eee6d93f8ff694973ae588382136715a6996228ff1fb9698c3312ada220c29d68eb9778e387c111e2587f734c5a2206451b10a4d7cbc2124d890b006511ab0e172dd3201332200d29bc641364d5fabb30c01ba0653e89c9a80a19616208ea111e419e121cf1b7f9a4bfc9d767933f0fcdc8d3a9077bbf1252ca95d216bddc4f84fcb68c618dcf303bb511816397a5e076431a1d207146331c56bb6a64231cbb114c4f59500bc37738ea8d7cba23c285d77b0ee39b64015c3a1a6fd9d371bbd3beab3e3e674d5447adb13cbba837f1316acc178c21ec684d17eaeb080e4e21ff53222ff587ae74ef23ff32d989b706cfde9efaf6345dd8caf8c8256c0c4c66e45aac01721500c15849adf2a2cd9f5cb2421c2271263fd9c3d785c9dd96492515423f005aa2ca8e0f0f260e2b4fd759aee97f8893593b753ee7ebf833a20536ecf8d637400713533e2394faf83044c0271922cf1e3b49fb4ada1afa29109d9d63b6c0b9c4a8235ff2eb6c4163cf1eba7ac79c87e2672296eca23f01c1821c98c1ff31fcfba04df25e274c66b17ae807b41d9d3594ba3ffae2c95996d74adef6bfba83899ae78fedd360a5381c12621418de78e89e8f942a77763141491d0d24aa867a0e199c909acc061cee0d2a89382d23e299b3192833d443fa3ee822f6b16af4b9327d4c42cde09475da763d36a4463cae15ea02d2cea66c7d02b6145cb4195bf92ba027bf416359d5aa486c7d570823c4094a4dfda32a24427e952499a89f62a99f5137d87f32f14cf2707b9e991478f6fe4d68a7a3a07bf06c0a4bb61e14050856e4089c1586002ecbad422d8f0420cb62078395af7f30a7188b05eed9de1586b6c81ea5926ff8339e7c3d77b344fd19e9b9e3628cec25fd1ae38491bc23655f146a6a2933784422b24e1ba522dddd0fd6d4c7625f40e8334dccc325f61fe1f1be48c7da4d239e2e6cfaac4599267fd524eed9715895de79069a24fd74325a7c8b0590478ecf363f08a8dd5c1cf2725a2316955ba2ec969bee05ca07d9bd29da6efb40e8586e8a547ba280c8d728ad0ed752ef9275e9364fe03e9959f1b6928c0865f6c6490791faf9bcdad7e28c9569ddc705291c7b7dc9ae7dba285116b361037097a24450db61fd26cd15ca126c7a36c03d9f25971ddd5400bf9d9eec36a7ec85fbdc97c69fadc9f5c25185fdb3ffff8b41e1660d4e259bd7f9a911eab0223d780844edf92c2349e62a61a11bfb38f7dc07f86969f4c11135c6628df583fe738b8371729c1234296abbde3fa5a2edf26ea5e0671a643d56555352921bb4144fdee71aa083d4e22b7d10834c0f41b110fa91c224273e98587d9849a950e73999cd123963440220ddd6b9df773ccfe15ff2272633310e38018bc4761e1c236e55c46487bac938fc4d69edd1bbf65b5f6f283b3bcb22c7202bc680768791ab37a9bee1dc66d58e6f6bf2a1ae72d02e7b2b98fa213dc039d24417cafe816906a4837a589ff522986cd6d906f35575f84d141c98ca76874b1a4a201d7e80becb9ef782030a7fba0cf753923763e3da9b4b92ef58ca820444a264dd51766be1f7dfa0274a8344bfe3f86e085551b135afba6d8a75ab6f113babb96d7fd20104c59a892eb5862b5ab6e6328cd45f7606ec814bdb332612ed8c7f3e7420daf345aef9d2fb0aba6667482fea9982e356b2e6171bd373979ad12aed6e306bea626296f7792e9f24311d5bdd1595f44b8da669d0f27c2f9f2588411d0462677503dc9be44bc91b5a9f7754c1861d30e753fb2bf9431d26c3c8a2fd86c8108fe3f09de819a73603885e6950331bd70b199d0766d026822f3972454f950990ef15e1cc4db980bbdf88f073ff427b2273e7f0f4c32aba18d6fa8b8cbe8771a0e0dfb17f4f66495505f13901dcc6bccae9f5a62dcda2f1e61478f3b60aec36edec281a7667a3b188b5a2d114fe3d5e3eb53403004ad5a6a55167ffc28891762930a6686596b22a052dbafb"}, {0xe0, 0x10f, 0x1eb, "db1d48370ae7f129724badadd80746b8caedb19b557400c6a6d7a645ae8414dc70c8b58de307e44293cd07d5238f23186090c7f474d398920d055e9a8ed48127098e25df6c13dbf7824111a5dd5b75eea13b38bc6b87bf40a71ba6ca8d52f1a9837403b4aa16da6fc20207107bd72a38c7479d852803d994dcf3324ff81339f827b09d02a8b0b321b56a8440009d38bb927d75652d6bc3706751b0adadaca7e212baffab01cd40989203146219ee1ea090c4c4890bf05f729bd60cdebf8f8490d0130021088c3d40708652657661"}], 0x10f0}, 0x1}, {{&(0x7f0000002900)=@pppol2tpv3in6={0x18, 0x1, {0x0, r2, 0x2, 0x0, 0x0, 0x0, {0xa, 0x4e24, 0x10001, @ipv4={[], [], @empty}, 0x80000000}}}, 0x80, &(0x7f0000002a80)=[{&(0x7f0000002980)="4d952a3f8b9d1e550d4de6f93fc85f103bce3153ff33c6773187cf85e6d5cf972030abadfceb5d36f4c97dc142ae05cf8772cc72aee2526b9411caf923bd8a075264440c11f9e73b6e882d92f0b98e9b008fc8b7fbe0a89933edca9f9c885cac0feabd329e4498bec675e91e2b4f4bc1d298728bf3596fc3f73e8a29c827b35e2a450b7b173da5ffaf5cd354337dcdd7e11bbf92698fd3387344ed95f976c80281890ec0321efe27ec8e2f0ea53615e26933c24a511c80436339be2686f5920cef3a63343ce09857de77ed238bf8900c", 0xd0}], 0x1, &(0x7f0000002ac0)=[{0x60, 0x10e, 0x1f, "1b339a66624d6265c80f2d2a60345fe725f9d0d3481ea0ff4b5bcd046bc7fc00d4b509a41e0d228743e4ac31d653fe5d92d7c404a017767989476f83b48aaac87e01e24fcd6fb23de8fa7a31d2a4"}, {0xb0, 0x114, 0xa6e7, "595f2fec47dbc0cad2e5064334659c500290c654ea8b65259a9c4ff4032359861c36069937715988b22a1d2bfba64e70d9327824b165cd75c478a13a83862c8ccd4a0cae4f67ab52998de75e8bec7cc955d918fe494ebdec4f25778ef3352840c001b1b0a86b6f1219d82a1a28d07b541a0e7be7eb204b77853eb9d60c8dc02af39eabe6d06edc2a07b8ea4d2bb05c369588b639bfeebabc8d3c0ce5f001"}, {0x38, 0x101, 0x0, "89ac25cc84f276363f2ed8f3ae19302dee9912631ba3fe5b13428d7a227e88b6be945c"}, {0x40, 0x0, 0x6, "568091a5c809c6269a60c8b46afe964cb4d0210d26472915f74e16e841b87447c655717164ee3610c4db7a"}, {0x28, 0x0, 0x99b, "18a8a041a120ff0c0afeb0177f021137a2"}, {0x58, 0x10c, 0x1, "b3bbd9fb50da28ec135830a66d1575cef948ad28ba062951f173d7d53f5e194ef34886fe2172748d97b97af5098f8dbbb41eef1e1f0b3bc9b1f7808e944efdd58851a0"}, {0x108, 0x117, 0xffffffffffffff22, "6a3f446cfedbd1d40bc2c103681ebaab034497303634b8ddfd6eca54361312cafa319241749c92ab43bdefa79bc1bf51deed1e18ffc80853498bf0b1aa95b7eb6a8d9a953e493f8e5b572aea7a2cc3d26a771bb2b7fc59448119cbeae9425033b03761f1e980dead708f42d420f0006920e98d80df2c3e030633b7a62c5821214545dd57cec460581cc73c931287bae795e1890cd8c63b99768deba849f8b836881924a140084cb218f4fc0fa68cc6080bd3652124201f5a29a517e69a7c540e63d68b7fdd9b6850a2765ac7b45bf7c03d4cfb2bfcf529b9673aebed09a7e48aa4752adf69b75f9699a99b57d455397bd597"}, {0x100, 0x13f, 0x5f83, "773bbd81503a93cfb4bfe774ec29dc98cc1f28f9fdcfb11032dd9b97de5c69120df5aed5f260849b56228120c11961dce4da0283f0372f39b8fd74d9bd9a2caa0a68243f96477eb43172ab466794d6fdadaf177459b72cd27e0589a7aabd8bc29337f6b62f510fdaf5de87ed36031f138bf8a26b2cd921eb796aa8a739290ea34a0d1b3924f408817908e546e2e5f9686603f391e44a93fd7bc2eb7b6900c50f77a5ea2a573d74e8feead772dab410cfe3359d5c5bb189db2eea89b71d889c782e2bea46b9baf15982e431c809df84e3b1c706b15f9fb85e9c8028a2bd16afbd5f193306ed94e1598371df48d8b6"}, {0xf0, 0x118, 0x2, "4abb56e060372bed1676fbf9a68682aa98f44992249e57a23aeac715e66d6492c47621d55c42e67189c08626524aef4389e5723cb4e6d2a5ef102e6823638919ff9060b10edc763851fa03e63d4da22fb0c84d4b72af46eccdcb3cc45bb00c7522659fc59db1a7d843fb8881eb7f1c782f3a9dbf34abef55bbf8c7efd3b39e1c641009f151e767966088288b4eafe9c8c9873a29f985274726a312156f82afe4ba2b0ec0d0b1707f8fa6b04282ed3b757d78a885bde6e01c78c674fe2fab70085fd1413b0a23121502b964144bcdebf35efc1feaf3d707161d575b"}, {0x20, 0x119, 0x7, "4ebcdcb176275fce26db4c7123"}], 0x520}, 0x4}, {{&(0x7f0000003000)=@nfc_llcp={0x27, 0x1, 0x2, 0x0, 0x3, 0xfffffffffffffffc, "6b0b910e3b971a53d02c9a9033709da08874e22217852f6688e4be5a78d119959a8fe19c86b6b0dfb984db31928d56c7595bfd8559c88dffbd0c2570d3e599", 0x1}, 0x80, &(0x7f0000003140)=[{&(0x7f0000003080)="f17733e6a7ee591034630889bd159544db29e24c13b2c78d3fa56324817ebb302cab0cd6349e91150162b0a79de133383973869129b26b49447b3b8aac7c85df2381c6fc14e694b2d1528fc852acb60163152cd7552765886d2d3fbe249c39190ef48202502f7b71a2afafbd2b2e80bb4afe3d592e710e4326a1fb5b", 0x7c}, {&(0x7f0000003100)="eed76dc8a5c7241ce6aa602b73948de2566eeba06b21e83807b623dfa5070ba96124560e", 0x24}], 0x2, &(0x7f0000003180)=[{0x20, 0x0, 0x1, "f2637e747aee04cae1"}], 0x20}, 0x9}], 0x3, 0x0) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000080)='TIPCv2\x00') sendmsg$TIPC_NL_NET_SET(r2, &(0x7f0000000140)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20400000}, 0xc, &(0x7f0000000100)={&(0x7f00000003c0)=ANY=[@ANYBLOB, @ANYRES16=r4, @ANYBLOB="000226bd7000fedbdf250f000000600007000c00030003000000000000000c00040000040000000000000c000300bb010000000000000c000300a1000000000000000c00040003000000000000000c000300f7000000000000000c000300260e00000000000008000100050000008000040014000700080004008000000008000300040000001400010062726f6164636173742d6c696e6b00000c00070008000200880000003c00070008000100050000000800020003000000080004000900000008000100090000000800040003000000080003000000001208000200030000000c000700080004000900000030000200080001000000000008000200000200000400040004000400040004000400040008000200fbffffff040004002400090008000100fcffffff08000200000000000800010001000000080001000001000054000900080001000100000008000100020000000800010008000000080002004000000008000100060000000800010000080000080001000800000008000200ff07000008000200090000000800020000630000280105000c000200080001000900000008000100756470004c0002000800020005000000080003000100000008000200240c0000080003000000a0000800030082c60000080003007f000000080001001c0000000800010003000000080001001000000008000100657468004400020008000300000400000800020006000000080001000f000000080001000200000008000200000100000800010010000000080002000004000008000400000400001c000200080004000a0000000800020006000000080004006439b46d1c00020008000229410000080002000700000008000300060000002400020008000100110000000800010003000000080004000000000008000400010000001c0002000800040002000000080001000000000008000200090000004c000200080002007c9a00000800020000000000080002000600000008000200020000000800010008000000080001000100000004000400080001000500000008000200810000000400040000"], 0x310}, 0x1, 0x0, 0x0, 0x40}, 0x20000010) socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r0, r1, 0x0) [ 366.694157][T30035] binder: BINDER_SET_CONTEXT_MGR already set [ 366.724178][T30035] binder: 30034:30035 ioctl 40046207 0 returned -16 12:46:15 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 366.782192][T30075] binder_alloc: 30034: binder_alloc_buf, no vma [ 366.794882][T30071] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 366.832504][ T7660] binder: release 30034:30035 transaction 132 out, still active [ 366.840980][T30075] binder: 30034:30075 transaction failed 29189/-3, size 0-0 line 3147 [ 366.855356][ T7660] binder: undelivered TRANSACTION_COMPLETE 12:46:15 executing program 3: r0 = syz_open_dev$vbi(&(0x7f0000000100)='/dev/vbi#\x00', 0x0, 0x2) ioctl$FS_IOC_FIEMAP(r0, 0xc020660b, &(0x7f0000000140)={0x6, 0xff, 0x6, 0x6, 0x2, [{0xed, 0x0, 0x0, 0x0, 0x0, 0x901}, {0x1, 0x4, 0xfff}]}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r2 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) getsockopt$bt_BT_SNDMTU(r3, 0x112, 0xc, 0x0, &(0x7f0000000040)) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/ignore_tunneled\x00', 0x2, 0x0) ioctl$SG_GET_LOW_DMA(r4, 0x227a, &(0x7f0000000040)) arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000080)) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r5, r2, 0x0) [ 366.879165][ T7660] binder: send failed reply for transaction 132, target dead 12:46:15 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 366.904788][T30075] binder: 30034:30075 ioctl c0306201 20000400 returned -14 [ 366.936230][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 366.989874][ C0] net_ratelimit: 22 callbacks suppressed [ 366.989882][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 366.995631][ C0] protocol 88fb is buggy, dev hsr_slave_1 12:46:16 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0xc020660b, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:16 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400a00, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x5460, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:16 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = dup3(r2, r1, 0x0) ioctl$TIOCLINUX7(r3, 0x541c, &(0x7f0000000040)={0x7, 0x5}) setsockopt$bt_BT_CHANNEL_POLICY(r3, 0x112, 0xa, &(0x7f0000000000)=0x5, 0x4) 12:46:16 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:16 executing program 4: r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="180000013200000106000000000000100000000000000000"], 0x18}}, 0x0) [ 367.456401][T30189] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 367.467611][T30192] binder: 30181:30192 ioctl c0306201 20000400 returned -14 [ 367.469780][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 367.480613][ C1] protocol 88fb is buggy, dev hsr_slave_1 12:46:16 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:16 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = syz_open_dev$mouse(&(0x7f0000000080)='/dev/input/mouse#\x00', 0x8001, 0x100) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000100)={0x0, @in={{0x2, 0x4e23, @loopback}}, 0x0, 0x6}, &(0x7f00000001c0)=0x90) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000200)={r2, 0xff}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r3, 0xffffffffffffffff, 0x0) 12:46:16 executing program 4: r0 = open(0x0, 0x0, 0x0) perf_event_open(&(0x7f0000000800)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) kexec_load(0x100697, 0x10, &(0x7f0000000180)=[{&(0x7f00000001c0), 0x2, 0x9e945000, 0x3e0000}], 0x0) ioctl$SG_SET_COMMAND_Q(r0, 0x2271, &(0x7f0000000000)=0x1) [ 367.502733][T30235] binder_alloc: binder_alloc_mmap_handler: 30181 20001000-20004000 already mapped failed -16 [ 367.536576][T30192] binder: BINDER_SET_CONTEXT_MGR already set [ 367.547638][T30192] binder: 30181:30192 ioctl 40046207 0 returned -16 12:46:16 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400b00, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 367.611661][ T7660] binder: send failed reply for transaction 135 to 30181:30192 [ 367.612492][T30235] binder: 30181:30235 transaction failed 29189/-22, size 0-0 line 2994 [ 367.619303][ T7660] binder: undelivered TRANSACTION_COMPLETE 12:46:16 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 367.674950][ T7660] binder: undelivered TRANSACTION_ERROR: 29189 [ 367.708428][T30235] binder: 30181:30235 ioctl c0306201 20000400 returned -14 12:46:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x40046205, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 367.733891][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 367.743069][T30341] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 367.843737][T30419] binder: 30418:30419 ioctl c0306201 20000400 returned -14 [ 367.901091][T30422] binder_alloc: binder_alloc_mmap_handler: 30418 20001000-20004000 already mapped failed -16 [ 367.926122][T30419] binder: BINDER_SET_CONTEXT_MGR already set [ 367.932971][T30419] binder: 30418:30419 ioctl 40046207 0 returned -16 [ 367.940156][T30422] binder_alloc: 30418: binder_alloc_buf, no vma [ 367.946538][T30422] binder: 30418:30422 transaction failed 29189/-3, size 0-0 line 3147 [ 367.955201][T30422] binder: 30418:30422 ioctl c0306201 20000400 returned -14 [ 367.963085][ T7669] binder: release 30418:30419 transaction 138 out, still active [ 368.009612][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 368.029769][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 368.032144][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 368.035555][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 368.090590][ T7669] binder: send failed reply for transaction 138, target dead [ 368.269837][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 368.275822][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 368.279780][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 368.287322][ C1] protocol 88fb is buggy, dev hsr_slave_1 12:46:19 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400c00, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:19 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:19 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0xc020aa00, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x40046207, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:19 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x74, 0x4) bind$inet(r0, &(0x7f0000000180)={0x2, 0x4e23, @multicast1}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000b86000)={0x1, &(0x7f0000f40ff8)=[{0x6, 0x0, 0x0, 0xe8}]}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000005f80)='bbr\x00', 0x4) r1 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000040)='/dev/btrfs-control\x00', 0x4900, 0x0) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000080)={0x2, 0x6a0, 0x81, 0x0, 0xa7, 0x7, 0x100000001}, 0xc) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000005340)={0x2, 0x4e23, @local}, 0x10) write$binfmt_elf64(r0, &(0x7f00000055c0)=ANY=[@ANYBLOB="7f454c4600000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000003800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x2d8) sendto$inet(r0, &(0x7f0000000000)="b5", 0x1, 0x0, 0x0, 0x0) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000140)=0xda9, 0x1) sendto$inet(r0, &(0x7f0000000f40)="03f4a2c970de1d9c3776a9481255ced5dbc57fe63cd931916a02bae17f782faea473b1c2395dcc0f572febcadeb7fa0f2ee9dc78ccc69169ccfc0bf46dbaba25f3f5a75b77654c0cb9989ea026da080991348232bc2541328a29ec7e06942980144d2ae1b8811ef7af232c4bcb7d89d1aafda6e27d68ed8047debe4f6acdb39851142538045af7a37276d45101a908acd7e6586aaa477a1ed765207d078f68d3f09646ebb175b64f48673bab39a740b280f8876953befe1c9eb8b1494786cdda1a87dbce11989c23041ee13071a5af0e17e267cc0bf8e310b695e5f3bf0f5e0a5ba3393a682e7d0cc9a93e2c8faa4f71f684e0ac9feb65e2a8cb931b4bc84551fe3bc41bdd5d148b8b366152e78e76a6b4bf34f883b99166fc25192d0ea28755cd248b191b5951e5e9ec835e6346d71f731b28e9ad931c763aa39e5da99743f9456069cc9b68fe6eddab20e52fa3d53c", 0x150, 0x0, 0x0, 0x0) 12:46:19 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000, &(0x7f00000000c0)="0adc1f123c123f1188b074") write$binfmt_elf64(r0, &(0x7f00000003c0)={{0x7f, 0x45, 0x4c, 0x46, 0xe81, 0x800, 0x1f, 0x7, 0x2, 0x3, 0x3f, 0x80000001, 0x24a, 0x40, 0x292, 0x8, 0x6, 0x38, 0x2, 0x3, 0x8da0, 0x2}, [{0x5, 0x7b4, 0x2, 0xfffffffffffffb82, 0xc727, 0xfffffffffffffffd, 0xd80, 0x5}, {0x6, 0x0, 0x9, 0x7, 0x0, 0x0, 0x9, 0x100000000}], "569ea5a4d64be36624c355c4c2965bcdd7c217bd3a", [[], [], [], [], [], [], [], []]}, 0x8c5) r1 = syz_open_dev$vbi(&(0x7f0000000180)='/dev/vbi#\x00', 0x0, 0x2) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000240)='TIPCv2\x00') sendmsg$TIPC_NL_NAME_TABLE_GET(r1, &(0x7f0000001000)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000280)={&(0x7f0000000d80)={0x26c, r2, 0x0, 0x70bd2c, 0x25dfdbfb, {}, [@TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xffffffffffffff7f}]}, @TIPC_NLA_NODE={0x24, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x40}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4546}]}, @TIPC_NLA_MEDIA={0xd8, 0x5, [@TIPC_NLA_MEDIA_PROP={0x34, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffffd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8a3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10001}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}]}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xcaa3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xa7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000000}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x55f}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xd5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x32}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100000000}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1812dc32}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_SOCK={0x1c, 0x2, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x40}]}, @TIPC_NLA_MEDIA={0x10c, 0x5, [@TIPC_NLA_MEDIA_PROP={0x14, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x594}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x7}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}, @TIPC_NLA_MEDIA_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x54, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x100000001}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x10000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2b52}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff7fffffff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x800}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffffffffffc00}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}]}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xb44d}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100000001}]}]}, @TIPC_NLA_NET={0xc, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x3fffffffc0}]}, @TIPC_NLA_NET={0x10, 0x7, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}]}, @TIPC_NLA_MON={0xc, 0x9, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}]}]}, 0x26c}, 0x1, 0x0, 0x0, 0x20040001}, 0x20000081) r3 = socket$inet6(0xa, 0x3, 0x2f) rseq(&(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={0x0, 0x7, 0xfff, 0x8}, 0x4}, 0x20, 0x1, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) r5 = dup2(r0, r0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x10000, 0x0) ioctl$SIOCAX25DELFWD(r5, 0x89eb, &(0x7f0000000100)={@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default}) sendto$inet6(r3, &(0x7f0000000040)="6e7e5bbbd833fe1cb69c16c5ed9918a1dc3c714f88a15ac6e5d61bf8bf620d5513619f4fc395f728dd2532b78e30b867108e8eee2194543c81ded6f2a2310b7840997948e48abdece7514faf31f682", 0x4f, 0x4000000, &(0x7f00000001c0)={0xa, 0x4e21, 0x35, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x1}, 0x1c) pwrite64(r4, &(0x7f0000000cc0)="a62058e563dbed0281916a844728bd92c9655bb3ebe49bb1dceae0c5b032f9386074dc52e747565e6694b9281e62a45a84f80f38828023644d44e57ad59db7db683050482f4ca0740fe3776ebc5dda1e18870c91bd0ab06d64847914c6ad3da8567575102cc2d27501c8d461e487254c69b94694550615c8a33c930ee22f8d373e64d4e55e551fc6e0c8112032dd421580", 0xfffffffffffffed8, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) dup3(r3, r3, 0x0) [ 370.473585][T30430] binder: 30429:30430 ioctl c0306201 20000400 returned -14 [ 370.521032][T30428] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 370.530783][T30441] binder: BINDER_SET_CONTEXT_MGR already set [ 370.536902][T30441] binder: 30429:30441 ioctl 40046207 20000040 returned -16 12:46:19 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:19 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) dup3(0xffffffffffffffff, r1, 0x0) [ 370.568408][T30441] binder_alloc: binder_alloc_mmap_handler: 30429 20001000-20004000 already mapped failed -16 12:46:19 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400d00, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 370.614682][T30430] binder: BINDER_SET_CONTEXT_MGR already set [ 370.636392][T30430] binder: 30429:30430 ioctl 40046207 0 returned -16 [ 370.655796][T30508] binder_alloc: 30429: binder_alloc_buf, no vma [ 370.669459][T30508] binder: 30429:30508 transaction failed 29189/-3, size 0-0 line 3147 12:46:19 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000080)="0adc1f123c12a41d88b070") r1 = socket$inet(0x2, 0x4000000000000001, 0x0) r2 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm_plock\x00', 0x200, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000140), 0x2, 0x1006}}, 0x20) bind$inet(r1, &(0x7f0000deb000)={0x2, 0x4e23, @broadcast}, 0x10) sendto$inet(r1, 0x0, 0x0, 0x400200007fe, &(0x7f00000002c0)={0x2, 0x10084e23, @local}, 0x10) write$binfmt_elf64(r1, &(0x7f00000016c0)=ANY=[@ANYRES64, @ANYRESDEC, @ANYRES16], 0xffffffe6) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f00000000c0)='highspeed\x00', 0xa) recvmsg(r1, &(0x7f0000000240)={&(0x7f0000000000)=@nfc, 0x9005, &(0x7f00000001c0)=[{&(0x7f0000003ac0)=""/4096, 0x20013a5a}], 0x1, &(0x7f0000000200)=""/20, 0x811e}, 0x100) 12:46:19 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 370.725523][T30555] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 370.725893][T30430] binder: BINDER_SET_CONTEXT_MGR already set 12:46:19 executing program 3: r0 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000140)='/proc/thread-self/attr/exec\x00', 0x2, 0x0) fgetxattr(r0, &(0x7f0000000180)=@random={'os2.', '\x00'}, &(0x7f00000001c0)=""/96, 0x60) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f0000000000)="0adc1f123c123f3188b070") r2 = syz_open_dev$vcsa(&(0x7f00000000c0)='/dev/vcsa#\x00', 0x81, 0x0) ioctl$SG_GET_RESERVED_SIZE(r2, 0x2272, &(0x7f0000000100)) r3 = socket$inet6(0xa, 0x80000, 0x32) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) fsetxattr$security_smack_entry(r1, &(0x7f0000000040)='security.SMACK64MMAP\x00', &(0x7f0000000080)='{\x00', 0x2, 0x1) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r4, r3, 0x0) [ 370.801005][T30508] binder: 30429:30508 ioctl c0306201 20000400 returned -14 [ 370.808000][ T7660] binder: release 30429:30430 transaction 141 out, still active [ 370.818054][T30430] binder: 30429:30430 ioctl 40046207 20000040 returned -16 [ 370.827059][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 370.835858][ T7660] binder: send failed reply for transaction 141, target dead 12:46:19 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x401020, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x40046208, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 370.852048][ T7660] binder: undelivered TRANSACTION_ERROR: 29189 [ 370.937561][T30671] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 370.992719][T30675] binder: 30673:30675 ioctl c0306201 20000400 returned -14 [ 371.027605][T30679] binder_alloc: binder_alloc_mmap_handler: 30673 20001000-20004000 already mapped failed -16 [ 371.064968][T30675] binder: BINDER_SET_CONTEXT_MGR already set [ 371.073719][T30675] binder: 30673:30675 ioctl 40046207 0 returned -16 [ 371.080598][T30679] binder_alloc: 30673: binder_alloc_buf, no vma [ 371.087173][T30679] binder: 30673:30679 transaction failed 29189/-3, size 0-0 line 3147 [ 371.096324][T30679] binder: 30673:30679 ioctl c0306201 20000400 returned -14 [ 371.104669][ T7660] binder: release 30673:30675 transaction 144 out, still active [ 371.112909][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 371.118936][ T7660] binder: undelivered TRANSACTION_ERROR: 29189 [ 371.125902][ T7660] binder: send failed reply for transaction 144, target dead 12:46:20 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0xc020aa04, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:20 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:20 executing program 4: r0 = syz_open_dev$usb(&(0x7f0000000040)='/dev/bus/usb/00#/00#\x00', 0x10001, 0x80) ioctl$VIDIOC_SUBDEV_S_CROP(r0, 0xc038563c, &(0x7f00000000c0)={0x0, 0x0, {0x8, 0x2, 0x1f, 0x9}}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r1, 0x8912, 0x400200) r2 = socket$inet6_udplite(0xa, 0x2, 0x88) r3 = socket$inet6(0xa, 0x880002, 0x0) r4 = dup2(r3, r2) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @remote, 0x9}, 0x1c) getsockopt$MISDN_TIME_STAMP(r4, 0x0, 0x19, 0x0, &(0x7f0000000380)) 12:46:20 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x401100, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:20 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xce0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f0000000100)={r2, @in={{0x2, 0x4e23, @loopback}}, 0x5, 0x8}, &(0x7f0000000080)=0x90) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = dup3(r3, r1, 0x0) ioctl$DRM_IOCTL_ADD_MAP(r4, 0xc0286415, &(0x7f00000001c0)={&(0x7f0000ffe000/0x2000)=nil, 0x3, 0x5, 0x24, &(0x7f0000ffd000/0x2000)=nil, 0x100000000}) ioctl$UI_SET_KEYBIT(r4, 0x40045565, 0x24c) 12:46:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x40049409, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:20 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 371.383813][T30694] binder: 30693:30694 ioctl c0306201 20000400 returned -14 [ 371.393910][T30692] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:20 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x1, 0x0) r4 = syz_genetlink_get_family_id$team(&(0x7f0000000080)='team\x00') accept4$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000140)=0x14, 0x80000) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000180)={'vlan0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000004a00)={'ipddp0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r3, &(0x7f0000004b40)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000004b00)={&(0x7f0000004a40)={0xa4, r4, 0x300, 0x70bd27, 0x25dfdbfd, {}, [{{0x8, 0x1, r5}, {0x44, 0x2, [{0x40, 0x1, @priority={{{0x24, 0x1, 'priority\x00'}, {0x8}, {0x8, 0x4, 0x7}}, {0x8, 0x6, r6}}}]}}, {{0x8, 0x1, r7}, {0x3c, 0x2, [{0x38, 0x1, @lb_stats_refresh_interval={{0x24, 0x1, 'lb_stats_refresh_interval\x00'}, {0x8}, {0x8, 0x4, 0x20}}}]}}]}, 0xa4}, 0x1, 0x0, 0x0, 0x4000}, 0x8800) dup3(r2, r1, 0x0) 12:46:20 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x100000890e, &(0x7f0000000240)="0adc1f321f85123c12a41d88b070") r1 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000200)='/dev/sequencer2\x00', 0x0, 0x0) ioctl$KDGKBLED(r1, 0xc08c5102, &(0x7f0000000040)) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000080)={0x0, @in6={{0xa, 0x4e22, 0x80, @mcast2, 0x9d}}, 0x5, 0x1, 0x3ff, 0x1, 0x4c}, &(0x7f0000000000)=0x98) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r1, 0x84, 0x79, &(0x7f0000000140)={r2, 0x441, 0x3}, 0x8) getsockopt$inet_sctp_SCTP_RECVRCVINFO(r1, 0x84, 0x20, &(0x7f00000001c0), &(0x7f0000000280)=0x4) ioctl$KVM_IOEVENTFD(r1, 0x4040ae79, &(0x7f0000000300)={0xf000, &(0x7f00000002c0), 0x2, r1, 0xc}) ioctl$sock_inet6_tcp_SIOCATMARK(r1, 0x8905, &(0x7f0000000180)) [ 371.443399][T30701] binder_alloc: binder_alloc_mmap_handler: 30693 20001000-20004000 already mapped failed -16 [ 371.461367][T30694] binder: BINDER_SET_CONTEXT_MGR already set [ 371.467397][T30694] binder: 30693:30694 ioctl 40046207 0 returned -16 [ 371.475178][T30701] binder_alloc: 30693: binder_alloc_buf, no vma 12:46:20 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x402000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 371.526742][ T7669] binder: release 30693:30694 transaction 147 out, still active [ 371.535141][T30701] binder: 30693:30701 transaction failed 29189/-3, size 0-0 line 3147 [ 371.548723][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 371.565313][T30701] binder: 30693:30701 ioctl c0306201 20000400 returned -14 12:46:20 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 371.580386][ T7669] binder: send failed reply for transaction 147, target dead [ 371.595166][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 12:46:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x4018620d, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 371.668235][T30796] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 371.699212][T30827] binder: 30826:30827 ioctl c0306201 20000400 returned -14 [ 371.714166][T30827] binder: BINDER_SET_CONTEXT_MGR already set [ 371.743455][T30827] binder: 30826:30827 ioctl 4018620d 20000040 returned -16 [ 371.767550][T30832] binder_alloc: binder_alloc_mmap_handler: 30826 20001000-20004000 already mapped failed -16 [ 371.805929][T30827] binder: BINDER_SET_CONTEXT_MGR already set [ 371.813847][T30827] binder: 30826:30827 ioctl 40046207 0 returned -16 [ 371.838868][T30832] binder_alloc: 30826: binder_alloc_buf, no vma [ 371.849170][T30832] binder: 30826:30832 transaction failed 29189/-3, size 0-0 line 3147 [ 371.869577][ T7660] binder: release 30826:30827 transaction 150 out, still active [ 371.876268][T30832] binder: 30826:30832 ioctl c0306201 20000400 returned -14 [ 371.878121][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 371.892620][ T7660] binder: undelivered TRANSACTION_ERROR: 29189 [ 371.898996][ T7660] binder: send failed reply for transaction 150, target dead 12:46:21 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0xc028aa03, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:21 executing program 4: mknod(&(0x7f0000000300)='./file0\x00', 0xc400, 0x8) r0 = openat$cachefiles(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/cachefiles\x00', 0xa040, 0x0) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000200)={'team_slave_0\x00', {0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x19}}}) r1 = syz_open_dev$audion(&(0x7f0000000100)='/dev/audio#\x00', 0x5, 0x100) write$9p(r1, &(0x7f0000000140)="351c57975bf68d12318f45ce8e82dee09142d6c02c05fe2280215fc9b28b8eb15b81c9850fa7320b9de35fe67f077bd9f10e9c7333e1af648d657b9ac8106f36edb80a5839b1719a736b833229fe4edc206e18c0334aae7262a44b80", 0x5c) ioctl$sock_bt_hidp_HIDPGETCONNINFO(r1, 0x800448d3, &(0x7f0000000440)={{0x8, 0x55, 0x1, 0x20, 0x80000000, 0x5}, 0x80000001, 0x8, 0x5, 0x1, 0x4, "4d7073c13d86b91d32c95e27fd5ad67b606db8f80384a69498259bccd4b301400f7726ba727ae3010a95fee0335e821903e4920f4f294a8e9eb032f8bd3a32db82980d4ebb4389ea6991afd26d8fad4c627bd43454756d940f1a45c6aab79c5c6d60e5082c47bd4d114e58b674e59a726cd778a70620a8e2b9560bdedbb50e1a"}) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000240)='/dev/zero\x00', 0x20401, 0x0) ioctl$sock_x25_SIOCDELRT(r2, 0x890c, &(0x7f0000000340)={@remote={[], 0x3}, 0xb, 'veth0_to_bridge\x00'}) ioctl$VIDIOC_S_AUDIO(r0, 0x40345622, &(0x7f0000000000)={0x3, "df8ed300e2c521f78f360f5b1d348952d6fb54427cb3b3aa4e34795eaf7e19d3", 0x2, 0x1}) openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file1\x00', 0x400000, 0x0) ioctl$VIDIOC_G_DV_TIMINGS(r2, 0xc0845658, &(0x7f0000000040)={0x0, @bt={0x1ff, 0x9, 0x1, 0x2, 0x2, 0x8, 0x6, 0x1, 0x1ff, 0x400, 0x10001, 0x9, 0x9, 0x6, 0x4, 0x1d}}) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, 0x54) 12:46:21 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:21 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x402010, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:21 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="0adc1f1221123f0000002d") syz_open_dev$radio(&(0x7f0000000100)='/dev/radio#\x00', 0x2, 0x2) r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = dup3(r2, r1, 0x0) getsockopt$EBT_SO_GET_INFO(r3, 0x0, 0x80, &(0x7f0000000040)={'broute\x00'}, &(0x7f00000000c0)=0x78) 12:46:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0x4020940d, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 372.189782][ C1] net_ratelimit: 18 callbacks suppressed [ 372.189789][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 372.201257][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 372.279046][T30847] binder: 30844:30847 ioctl c0306201 20000400 returned -14 [ 372.287496][T30851] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:21 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) 12:46:21 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 372.327821][T30901] binder_alloc: binder_alloc_mmap_handler: 30844 20001000-20004000 already mapped failed -16 [ 372.349406][T30847] binder: BINDER_SET_CONTEXT_MGR already set 12:46:21 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x403a00, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 372.389006][T30847] binder: 30844:30847 ioctl 40046207 0 returned -16 [ 372.390885][T30901] binder_alloc: 30844: binder_alloc_buf, no vma [ 372.429814][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 372.435607][ C0] protocol 88fb is buggy, dev hsr_slave_1 12:46:21 executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) init_module(0x0, 0x0, 0x0) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @mcast2, 0x7}, 0x1c) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000540)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x2e) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x8140, 0x0) ioctl$UI_DEV_CREATE(r2, 0x5501) sendmmsg(r1, &(0x7f0000005fc0), 0x800000000000059, 0x0) 12:46:21 executing program 3: r0 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000380)='/dev/dlm_plock\x00', 0x18000, 0x0) ioctl$BLKBSZSET(r0, 0x40081271, &(0x7f0000001900)=0x5) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r2 = socket$inet6(0xa, 0x3, 0x2f) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r0, 0x84, 0x70, &(0x7f0000001980)={0x0, @in={{0x2, 0x4e22, @empty}}, [0xdcbf, 0x100000001, 0x1, 0x1, 0x40, 0x1, 0x173b, 0x7, 0x7, 0xff2, 0x17, 0x469, 0x5, 0x2, 0x8001]}, &(0x7f0000001a80)=0x100) getsockopt$inet_sctp_SCTP_RTOINFO(r0, 0x84, 0x0, &(0x7f0000001ac0)={r3, 0x8, 0xffffffff, 0x691c}, &(0x7f0000001b00)=0x10) getresuid(&(0x7f00000014c0), &(0x7f0000001740)=0x0, &(0x7f0000001780)) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000001640)={{{@in6=@remote, @in, 0x0, 0x0, 0x4e21, 0x4, 0xa, 0x0, 0x0, 0xffffffffffffffff, 0x0, r4}, {0x0, 0x0, 0x4, 0x2}, {0x0, 0x0, 0x0, 0x1}, 0x3, 0x0, 0x1, 0x0, 0x2, 0xfffffffffffffffe}, {{@in=@multicast2, 0x0, 0x32}, 0x80000000000000, @in6=@empty}}, 0xe8) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) r6 = dup3(r5, r2, 0x0) io_setup(0xfffffffffffffffe, &(0x7f0000000000)=0x0) getsockopt$inet_sctp_SCTP_RTOINFO(r6, 0x84, 0x0, &(0x7f00000002c0)={0x0, 0xdf, 0x7, 0x6}, &(0x7f0000000300)=0x10) ioctl$SIOCRSSL2CALL(r0, 0x89e2, &(0x7f0000001940)=@default) setsockopt$inet_sctp_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7b, &(0x7f0000000340)={r8, 0x1ff}, 0x8) socket$rds(0x15, 0x5, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r6, 0x810c5701, &(0x7f00000017c0)) io_submit(r7, 0x6, &(0x7f0000001600)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x3, 0x100000000, r1, &(0x7f00000003c0)="dec157995b1447917fad2972787da2bb6454820329fb1fc012c1925a715f4085895559c5ecb033133d00c4b935c4dc67f60ae003f90e589a96e15592551c8ab8ed67b2f6e8d4cbc798e1fcb26373ab19e1a3ac44d5e190ed73c52f5380643aecf52f04afd572e1cc000d9a9c40472f407ac3441b436cbe676b462346915ac44af0a0447f88e1caa9d2bb075e74d59bbbb17e1422eb9b2b57ee60fd0e3f3ba1313564d9011ef83ab18abb1f9f58dd4cc7302eb298b2443584161fdd8b908a6f463e1e9c019071944f2c618d15d8e4dd72087a305f1e15c46c4941bd943a87b65b1bc93bd9d92b17136ec494fdceeec96faf4a9cd45d973b1c12f878c3afd3733b4495ba1ef1c723f8e28ca988c92738fa3ed5ccbf23247e4f8e9d7a2a884a34da71decca23422a9314487bc078ea515efea171a2c2d4ad9d3cfa72f6754e8ab3d5b649ac097db983a3e3b3540d13a0642fcb0c136e43e274d2ffc19fb8f3dfbc3e0b3d67cee761a659fd543e7fdab074b08b2741232815c2b7d1cf62daf193427e14f1f39ba39963940990cc9ffae2e4681350822eaa319b321b6dc876797f3ce6ccd3fbd3216f9da1c7053316d6c6d9fa894265ecdfc369938bd31dc4def59da493511b1340b55b1250d9475d38e8c3494791d635eed5c4ee2bee7b2330acc84a53e8ad934b1cd1e08cf7c87621968e5f0011a38b5cc4ed79cc9d51ecc15c8c6c0b127e6241ea2b58e863286f87f9b4f4c467b58bf6f4898ccd32eb170c03b455f64cdb718cd7cc819c07f2d1dec4238a692d22fb7340f8b5fcddbdfd4e2b1f6e6968154dcac0333fe4a817eb5973b0ea6d04ffe76f4b464902b08e80f5757e404544a1d4b2ccfa7fb586e917932f9601763b700780e362d27312fb5473d3191a1617861c266949a2c42d62bf28c802b32c253194812d32d1b962b62e68a661bae332bf0f7b56ab2941e6840fb12b1d4711912159fc2046c9f4bc4d496a75863cfac44fcd1afc937a7d35972247c2fd39e8d50541df272c0f7495325d097d97cd4d8f9a54528972e0aea1d5c88cec57e02b96076756008bb7f06debcc2044b9e4ac9033830f07dd893bc692efc18ddf8f4734ada2a59a3b8d56c11c31067c6d96de8470bc953bf75f95ae806954d3344c090c3eccddd39c50ad755bab4d3485e01e26cac5bcf487e4ff3cbaace9e526140826bdfeb17c9152b760d305228d37fa461ef41c699ec96f13ab3d20f485196bad0136d42c97b5d457583f7dcad0c6a3ee406eb23213f7ab4e339bd5a5d2d1ca8bb8ea5ab9c3a63425baa2a149dcadc8fcc82eaf4e14c126850d7fd9cedcc63cc706a102e1f0399aeae19f87ef7d691884895008bb928a341e233c1809df3611643bf777d2ddb47549e00088b58a41123bec70a8eb42bb359041353d4fede5ab2ddfbe3485edcb8e5e67185f37b9c324b4277938d6e3a242cd3384b2830a3f3337127d0356789b696c498b61d55f2262d06247ee57f0bc9c56ae1e5519d9b5b538b4ba5f826a2a234e10c1b1062d1d9824a69f89d9afb4195875eb8d31db938601c1a2179a9a7e448251297c096641312686890fd8dcd589b5dfd06b0ed781fc51fb9aeb10e31b96a1feb24924b8db1fa88882c3bbe92951ec4a3a0e41fe5b3fc1114be2033ac9e478fc30ea00c5313b3290f6a52afcf38adc3da5fc24fac71addfcbf9dfa946dd3e7138e754f3d2d0b8168db63dfec6fef11c3f922a7757edf53f490e0fc1e650d571977affb12f94c38ea482dd11c807892acaf2950c83d6d376d7101d62e1474a8566fadd3b1a8c8edecdf299b21070d64d266d97a5500e4b5e57175691dbda6ff0a7cef3819373a0776df980ff9e3189ef36bd334d2890b37e5b427158400312188fb27c2a1a70334c3190ce9055ac8c513d95ead6e0d393e3c0df58a6567b48744321bc1fbc040163554b11f6813aa1b1540eaf9d8e59865d4293e9a145a3c4ad200d6d76c7e6070c2b830270842b1352268171c68f4d41bd74550974849d6c747e58742c7de79568bd6f8e68b2fc92123a91acf26d94951f08fb821bc4faafbbf42c8895ce50d29c209192cb403717f143482fa68a8ca1cb84cf7fb85c0c7475141b4037e196d2fc2b6c2f4e3c9b330f2ef2d72cced7505134501e17750a633355de905fe813a35661ccf169744a97228203e7aa9ee6fcf9effc119d4bbe1ef046a4656d36d957e15fe2d07f341dbca3b2276ce6e2a9b660eeea275c47f2cf8af8c215d85e4c4e7a89e9f79d0c9a07266b64b05b85cc4e2f2f79efaa483a92fdd7311087082c160a774d4d93cb834e80bf6b516012ef7529348bb39bad18ff3a677263a1c3bc60abdb2713f56a0b0da69372ab09d11a7152b124aaa412b80d206d36e3439f1298abb612f005b61a24cb2d52752e64dd03b08a3618354dfa22a4aafa27110680fcfeaf068850746057acc1a41a01b594708c4bd19fc484aa570315d594bd57841429f8bf8e124d7bd01815f83a26ebdea7e6ba4b9fdced832bf61dceff2b40810160bc86ffed5023ce3d93172e3cd095f26e4f40753847b2bbd009d7f7b97b57fd8aaf2cfad89b3ddb5e83711bbc5b2c19a0ef6ea3b7cf0a8e541db1d99b7ba5385ae2ccfcef64d01d9a7d8dce99ae32c2268aa64bd8e4571f6e20499fcbe714ab1b21c92c001a1f88b96b6ed66195538a6d21cedf296d3a73f54fb3ece5d3b367e222b48a52cc360736f79bbf8c32763abbee4d8053f87d249d58109dc57a0567a3e37fb4ff519f094ab5580cc41732f6588a0fb84780fe8e67ece9713232664058fc9b2d9a70eeab77b25997b66b8cdd3f9299a8cef3380e78ba2f1be1e8bca09b0f4d4224f098fc7d85879b230a9942897e013313afbaef4f708a25b80d8046645548b352d97f966588c9c16dc0d6a10a5b3fa2c4e700dfc26a1cadfd8ca23212ffe20cb6705ea4fe18397d81461c23815a2fe456e410b2f07ac4a9fd532d28440c1ebde0530319bd47f5dea773ccf76cab00e471fac70472780decb6ac528924f37c10bf227b79a27108f43eb1e40d9a18336678bf390fce5ed0dc0d3bed35e94ff24d13472ade261cbb9acf8f8a1355cd4a10d1459cc1fff80d731ed881f1c3a4e5ea8cedffa39001086b2292c834961cd22afc39e39ce17cc6df15f02d3c6ea6d8a283cace7e4ed33d4a8422a78f74e3af36dab2702813e916fa5b72cb38b967a58e12da01dea1eb6539edfc590f52bfb9f255dcfdb96ab468ca3a36a344f89b6f06ea2dd4851ca2e6b889951130d19b6d7e004cfc234160b0dbc7eebdd55011e48f16243fada067841e6391fc2e7de49fa79160c762bad4acf6d5065b461b41e84132d1b528c8e9b5ea94dbfa13e390acfbaa647efa368c46211f29752cb3f2aaed3595c805988aa749bc4b9ec0d96468b45772de4b837968c16f95af6ebcc6120b02b69b989340798d383a548d2457f3aa1c1ed57ffbd8f5571574c7e5f622ca3974a262363e8dc6a622519ba77c6aefbdcee30d6ec4daa1d452363de4565f49d2451cc29d084f522875687a9a5e3c85020fbe3ec3cd01c0221d38898ab2286e020311b9a620afa9a22dd2ad862606e7f9868fff9e36b1882bb3f363fdf3d273b943f4e6486fc2c12de16d2dfccf0754b686e8bc3c72061318eaefd5692c6cc807efeff873d59af8664754cbfc67e9b9b3834e33b867d08366062032973ecb26c397295d45e7416fd0016e48e4c41c75fcf1ecc10499520e6df714225f692c43fed42afae482004db4e1f5ca8088f3956ed535748b6fb537a4d65f7eb1bfbb701f24b616dc64bcf7e9088cb831c8ecab69f012688b1357e977e06662999a4315d3fe1f3793c6f1b69dcae16c3390f6063c343ca7d4af4b797c5274dbbf9af87aaee04a5db0dfcccedf853644d8fc89c6c2927e2c91fbd82c6063629e64e9518999493a9c64e0899b8fb1a84cdf58fc394047a0d2b99e2d22c87baec3712a0bf174e786338fa03f1cabbe7c28fa19c5fc70f32791c7c435a2d61d0ea99ca3a8aad88055670b0fb050973a927f494ddca3a3b95f180c5cec9553d8128d85630d77cc8d852dd4a3cd0a7062602f8557f8be7c9f94e3c7f9500caa07a4b3418034235f29c672dea77f0b98020945f3fad6aa444bd04d3c4432db15a29ecb1a926d82ab9315e315f3f4d49b35d28efb955e62017fec18d0b011b2ccef63d2d372b02edd3ba53b3175c8417d52da7a4529463ebf377c196d1f0d12d6c6400e20263ae43bd1fd41405f569536c8f134b42303add220be95e129488e3d7435a5019e0f95c8782d17bfd17566659ab8efc2bbddfca5b71fb9983cd6e0b104798d42012236aee3a9d6104664d34519175540db19c9bf57f5f4f76941136fe2fc607e5a6398418cb5c49917165e173f98a908d828aaba96be19350dcfd26ed0c31d3172bbdea6b4730538bb058fc2258699b38c4a07fd5b8d2364862cf9bd64c65d2357cab1017085dc528aba7ded1735a08249d5eaaa48e602e5e4ba97f587d8737260c3de9a33434323d63c98226a6e9a32044c2006fac6cd4ae5765bdabb686acdc7bc22fa2bdc31ff1220e1b33b384797f0e8ac1fcafdaad484843639927539e3716d4512e932609c6e6dc2f4cc90c19713bba9ba714588b1f696fa6b9546a2f4709422d189379bfa9e203196c92c666ded4a7985dbe1b92a16bbec46cbfc518905d0b1fac5efb28089f373ab9370ad1d38075f6bea8b7e865cc0e126baf4d6f03856c8a90ab5a5d3c4382099a626d45c0820252ac0b847bf724376c279ddfc925a61c2f3f43323fabea95f84161ca2752eacfc2647862da465decd0a70e9f7c4be7dbfee848e1cc4a3a3d7b73a8cc077e9543aa529014ca1872c909afcc1d1432bf3ad6bffb0f111953552d2880722c04e036697f94c4fa00f6b8f7135f7f3fe407b18ae8b279b7118efe7be3aebedc1c58538c18f0ea42a501ecae958ee7ac8cb1348d6e53ddb51538f1c3942d76834b91cb291e2376ea4ce4a82649297ab530496673ccf545a7ba5ca32303e24423853d296a2bda1074b0b50ed21fa9c00d91e1b27b42b16122ef358383f2045427bd04390e976df5dd18d9cc93aeca190d3571d4230682bcbdddcf1f6aa18eea9faf4e529e968a096cf1b537595cf4b27736b9de89e57d8781934d8a9117a699fb87056077a12aecb5fd09f5a63fea35ea398655adfcf1d9774093923e721c629d2dd883c17e378868606b713b9b39a0a1bdb8196c75aed9b63b7e644d033a5caa96cd5ad432a19e5fee168a32296a539957c2daa1b0bff840ba69e2eb5f7ceaa7f494779733baf8b229d11ad4b84980e458c7787a9476c602ee5cd0ce21ef871c39db6bd91bde822bf0ceb85a411b549c8f797b6e6d4265a45e1676dedd32dcaaf9f259c61039c9f40f200a4ed99a8f10af575cdc27eeea11a6ced04285a4133f0c1cb3bf2b2d6eb96b22992cab45a29b4e916567a1bd77bcb3e4f9095caad38a48f00d7b376f0ddc274d75d8cf1bbe3198f17b7b220039a35f04dea3fc135b914bde523c37f11028fd4211e740eccf3a5892151cd69c52e5552444bedd4abc197abf7d1456a4ea3f334eb60dddcf8b66129a63146cc894c4bbe2751bae088f7123b01ac577fa1ad0da72ea8bdad2f38240b2fc9a2774d13a4a740edba3e391a68417853f1a138a4eae974a99e9eef9269fd0835fd0258742fc675c9e7d7450ff79ac61cb0ab940de85b766808a3f03c9cb74a21bd41aef9b7f55ebd0dab337698cc5d2fb03224c66ab171d9a2e4c72c", 0x1000, 0x1, 0x0, 0x2, r6}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x1000, r5, &(0x7f0000000080)="8d273f26cf62d5a21d8ee2d19ba738b18a7c4a15c1b4232d76003d3af63da708d06c828ca6089bb133f436eb25b974", 0x2f, 0xfffffffffffffffa, 0x0, 0x2, r6}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x2, 0x0, r5, &(0x7f0000000140)="e9190ac8adc696bbf21c7e378f657e18b4ee283971362c80e42b9578cc85f3ab47528f99e66358689e34bc200608fb63b0249f042ff7bae2e6514023274de7a87b13a9db5043ace44402a4eb5e9cddb3ce9c57230f38adad240d5bcb65c7c170f1391f197688df7ae6d92e7d82e260ea79318d779e47f8c5cf9f469bad6d99a972658e4bd627addb20988054b2e4c9f2c576783bafb72f6c08df26d1718f477551a52b10d713c2abc9de254378e7ccf62e18d87ec83152febf4419f5558898a7b5c09b5f", 0xc4, 0x9, 0x0, 0x2, r2}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x2, 0x6, r5, &(0x7f00000013c0)="574143a7115f833194a144a23ee9acb9e73863f542ba928a05ca260fb2d1a36bd74b25c529f21f7ad81499e30530db3f94269f2992d50b82b248e4c8090d198ca29e2a4ef8a15741b88634af9e82c2fe04b09c819848b688737e56bf1cb848d4e81f1532878f0304c64eef1bf270cacce113a17e98ff288fef78961f3488ab9fe1c172b32ce19884ea37c41b29eb172380eca3c2d39da138930f0579f59beb25880d194b55a0f4775df3cbe692a5d83b080698eacc541c0d53bf8dcd4d0a6a18681a7454a119e0b27dc4c004f9447d87a32d684c438820", 0xd7, 0x3e, 0x0, 0x1, 0xffffffffffffff9c}, &(0x7f0000001500)={0x0, 0x0, 0x0, 0x6, 0x3ff, r5, &(0x7f00000014c0), 0x0, 0x5, 0x0, 0x1, r2}, &(0x7f00000015c0)={0x0, 0x0, 0x0, 0xd, 0x40, r1, &(0x7f0000001540)="7ce77bf169e71d9f300eb5db458c07d94d044fc1824f7a3227c6d7cc827846b11b73a897c0a6dfbfe50643045734aa6f97d185485fdd69ba28e68aa77b7358d8eb261e26266d4f4065974d9de123c2b255286e9c6344809f37dfdb", 0x5b, 0x3ea49472, 0x0, 0x3}]) [ 372.439809][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 372.447083][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 372.461269][ T7669] binder: release 30844:30847 transaction 153 out, still active [ 372.471022][T30901] binder: 30844:30901 transaction failed 29189/-3, size 0-0 line 3147 [ 372.503608][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 372.522580][T30970] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 372.524718][ T7669] binder: send failed reply for transaction 153, target dead 12:46:21 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 372.550036][T30901] binder: 30844:30901 ioctl c0306201 20000400 returned -14 [ 372.579221][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 372.991623][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 372.997424][ C0] protocol 88fb is buggy, dev hsr_slave_1 12:46:22 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc03f00}) 12:46:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0045878, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:22 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) r2 = syz_open_dev$vbi(&(0x7f0000000080)='/dev/vbi#\x00', 0x3, 0x2) ioctl$sock_kcm_SIOCKCMUNATTACH(r2, 0x89e1, &(0x7f0000000040)={r1}) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) accept4$alg(r2, 0x0, 0x0, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = dup3(r3, r1, 0x0) open_by_handle_at(r4, &(0x7f0000000100)={0x6b, 0xffffffffffffffff, "d2af7375b2045befcf0cc843cfcb88ca9bf453b39863681318b3549fdce8cc91ea9702a1fdc90247b151d99776d837dea0193b79c9b0c12f97c84a29d064c7297658470f5435969823904990c36ea71180447c06968d2b08ca38eeab052a7c343d9365"}, 0x40000) 12:46:22 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x403f00, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:22 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:22 executing program 4: r0 = mq_open(&(0x7f00000002c0)='\\\xf7\xa0\xcc\x16H-o\x007\xe6\xb3\x1a\x8eiz\xdd06P\xd4\x88\x00s\xefu\xdfa\x01y\xde\xc26\xaa\x04\xe9F\x87y\xba\a\x00\x00\x00\x00\x00\x00\x005\x98U\xb4\x9b\x88\x9b\xb5\xe4\x9b5\x8ey:oz\xf5\'f\xd6\xfe\x93\xca\x06r\xac\x1b\x8a\x87\xcafw\xd5\"\x0f\xb7|\xb6\x13\xb3\xdb\x91\x04\xd1j\xa1\xcal\xc7jt\xe7\xbdK\xdcR&u{\x03\xf8[\x01\x03$Wl@\xc1\xc8e\\s\x9f\xc1\xa6\x8d\xf5\xe2\xbc\xb6\xe5\xedF\xc8(\x9eH\xeau\xe7\x85\xeb]d\x97\xcd#;\x10\xb9\x182\xcf^1v|\x1cA\x9dFF\xcd\x88?%', 0x0, 0x0, 0x0) ioctl$RTC_ALM_READ(r0, 0x80247008, &(0x7f0000000100)) mq_getsetattr(r0, &(0x7f0000000040)={0x0, 0x0, 0x80000000000000, 0x0, 0x0, 0x0, 0x8000}, &(0x7f0000000000)) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000080)={0xffffffffffffffff}) bind$isdn_base(r1, &(0x7f00000000c0)={0x22, 0x0, 0x7, 0x2, 0x9}, 0x6) [ 373.185025][T31102] binder: 31094:31102 ioctl c0306201 20000400 returned -14 [ 373.195117][T31097] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 373.221781][T31148] binder_alloc: binder_alloc_mmap_handler: 31094 20001000-20004000 already mapped failed -16 12:46:22 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:22 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") pipe(&(0x7f0000000000)={0xffffffffffffffff}) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r1, 0xc0505405, &(0x7f0000000040)={{0xffffffffffffffff, 0x3, 0x4, 0x3, 0x9}, 0x0, 0x12, 0x7}) r2 = socket$inet6(0xa, 0x3, 0x2f) getsockname$packet(r1, &(0x7f0000002dc0)={0x11, 0x0, 0x0}, &(0x7f0000002e00)=0x14) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000002e40)={'sit0\x00', r3}) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r4, r2, 0x0) [ 373.229837][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 373.234244][T31102] binder: BINDER_SET_CONTEXT_MGR already set [ 373.237732][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 373.251616][T31097] overlayfs: filesystem on './file0' not supported as upperdir [ 373.259413][T31148] binder_alloc: 31094: binder_alloc_buf, no vma [ 373.269708][T31102] binder: 31094:31102 ioctl 40046207 0 returned -16 12:46:22 executing program 4: capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000100)) r0 = syz_open_dev$usbmon(&(0x7f0000000040)='/dev/usbmon#\x00', 0x6, 0x40) setsockopt$netrom_NETROM_T1(r0, 0x103, 0x1, &(0x7f0000000080)=0x200, 0x4) r1 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$DRM_IOCTL_GEM_FLINK(r0, 0xc008640a, &(0x7f00000000c0)={0x0}) ioctl$DRM_IOCTL_GEM_CLOSE(r0, 0x40086409, &(0x7f0000000140)={r2}) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, 0x0, 0x0) 12:46:22 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x404000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 373.295818][ T7660] binder: release 31094:31102 transaction 156 out, still active [ 373.304270][T31148] binder: 31094:31148 transaction failed 29189/-3, size 0-0 line 3147 [ 373.316453][ T7660] binder: undelivered TRANSACTION_COMPLETE 12:46:22 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 373.348870][ T7660] binder: send failed reply for transaction 156, target dead [ 373.363576][T31148] binder: 31094:31148 ioctl c0306201 20000400 returned -14 [ 373.381357][ T7660] binder: undelivered TRANSACTION_ERROR: 29189 12:46:22 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0045878, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 373.450407][T31259] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 373.525136][T31325] binder: 31324:31325 ioctl c0306201 20000400 returned -14 [ 373.537630][T31327] binder_alloc: binder_alloc_mmap_handler: 31324 20001000-20004000 already mapped failed -16 [ 373.554556][T31325] binder: BINDER_SET_CONTEXT_MGR already set [ 373.562016][T31325] binder: 31324:31325 ioctl 40046207 0 returned -16 [ 373.568761][T31327] binder_alloc: 31324: binder_alloc_buf, no vma [ 373.583365][T31327] binder: 31324:31327 transaction failed 29189/-3, size 0-0 line 3147 [ 373.595537][T31327] binder: 31324:31327 ioctl c0306201 20000400 returned -14 [ 373.606646][ T7669] binder: release 31324:31325 transaction 159 out, still active [ 373.623418][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 373.640140][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 373.652439][ T7669] binder: send failed reply for transaction 159, target dead 12:46:23 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc04000}) 12:46:23 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000000)='/proc/capi/capi20ncci\x00', 0x8000, 0x0) ioctl$DRM_IOCTL_ADD_BUFS(r1, 0xc0206416, &(0x7f0000000040)={0x3a41, 0x8000, 0x6, 0x7, 0x2, 0x7}) connect$l2tp(r1, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, r1, 0x1, 0x2, 0x0, 0x1, {0xa, 0x4e20, 0x3, @remote, 0x5d7e}}}, 0x3a) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r2 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$NBD_CLEAR_SOCK(r1, 0xab04) dup3(r3, r2, 0x0) 12:46:23 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/\x00~WM\x00\x030\x80\x90\"\xcf\xde&U]\xc9\xec\xfe\x19t@n\xda\xd3\x83dx-c\xb6a(T\xb9\xe4\x9d\xbd\xca\xefq\x81\x97\xe3~\x87\n0\x8b\x1e:y\x8f\xa7\x88\xa4m0%\xef\x93>Q\x82\x8a\xb6u\x06N*\xdb\xe9\x12d#\xb4\xa7=h\xfb\xe9\x9cm\xb2\xf1`\xd4\x9c\xb6\xcc\xe7l\'(\x9aO\x9d\tsT\xaa\xa5\x86\r#\x83\xdf\x87Rk\xaa\x18M\x90\xbbw)6l\x17\xbc3\xd7e\xe9\xbc/\x88*\x13\xf3\xa9\xc1\xf6\x06`\xbdO\xd2\xfa1\xd2\xc0\xa7u$\"\x89\xbc\xe0b\xd1\r$\xde\xd5@i\x18\xa6k,u\xc4?\xe1\xffE\x8a\xe5\xcd\x9f\xecc\x03\x9b\xa5\xa7\xb6j`\xed\xe5\xcc\xda\xbc~\xe7v`\xef#X\xcc\xdf\xf0\"&\x02\x13\x84\xb0\xc25\xf1\x14\xed\x9a\xde\x92vz\xec\xc2V\xac\xde\xb6\x10\xdfB\xe7\x16\x9f$\x03W\xf75\xae_\xe2\x90\x17\xe5\x1e\'%/H\xb9[\xfb\xbb:\x86U5)\x8b\xdc6\xd7\x1d\xb65\xf4\x1cWw\x1d\xb7z\xea\xff\x88?\xeb=\xc3\xcc$\xbd<\x03n9j\xd3\xaf7\x94PX\x83\x9e\x81\"p\xbc@\x90\x1f\xa6T\xe7\xcc2\x92\xa8/\xc8\f7M\xc0qB\xa1\xc2\xe9\xd3\xe2R\x8eO\xda\xc3+\xca\xef\xe9\x10\xeb\xd3\xb9H\xa3\xbf\xeb\xef_\xa8\xd8$s\xc7\xfb\xf3\xec', 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) fcntl$notify(0xffffffffffffffff, 0x402, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) r4 = syz_open_dev$sndpcmp(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_AGP_INFO(r4, 0x80386433, 0x0) ioctl$KVM_IRQ_LINE_STATUS(0xffffffffffffffff, 0xc008ae67, &(0x7f0000000300)={0x0, 0x1ff}) add_key(&(0x7f0000000440)='pkcs7_test\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffb) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000000)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000040)=0x1c) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r4, 0x84, 0x13, &(0x7f0000000080)={r5, 0x7f}, &(0x7f00000000c0)=0x8) getegid() getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) getsockopt$IP_VS_SO_GET_DESTS(0xffffffffffffffff, 0x0, 0x484, 0x0, 0x0) ioctl$TIOCGETD(r4, 0x5424, &(0x7f0000000340)) geteuid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, &(0x7f0000000b00)) memfd_create(0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) sendfile(r3, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, 0x0, 0x0) fcntl$notify(r0, 0x402, 0x22) 12:46:23 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:23 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x404800, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0046209, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 374.091271][T31341] binder: 31334:31341 ioctl c0306201 20000400 returned -14 [ 374.107143][T31342] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 374.123788][T31347] binder_alloc: binder_alloc_mmap_handler: 31334 20001000-20004000 already mapped failed -16 12:46:23 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x80002, 0xa00) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) [ 374.142322][T31341] binder: BINDER_SET_CONTEXT_MGR already set [ 374.159597][T31341] binder: 31334:31341 ioctl 40046207 0 returned -16 12:46:23 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:23 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x404c00, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 374.186194][T31347] binder_alloc: 31334: binder_alloc_buf, no vma [ 374.205528][ T7669] binder: release 31334:31341 transaction 162 out, still active [ 374.224981][T31347] binder: 31334:31347 transaction failed 29189/-3, size 0-0 line 3147 [ 374.246344][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 374.267327][ T7669] binder: send failed reply for transaction 162, target dead [ 374.279442][T31347] binder: 31334:31347 ioctl c0306201 20000400 returned -14 [ 374.306949][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 374.339445][T31462] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:23 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x405c00, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:23 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0x7fffdffe2000}) 12:46:23 executing program 4: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000100)='/\x00~WM\x00\x030\x80\x90\"\xcf\xde&U]\xc9\xec\xfe\x19t@n\xda\xd3\x83dx-c\xb6a(T\xb9\xe4\x9d\xbd\xca\xefq\x81\x97\xe3~\x87\n0\x8b\x1e:y\x8f\xa7\x88\xa4m0%\xef\x93>Q\x82\x8a\xb6u\x06N*\xdb\xe9\x12d#\xb4\xa7=h\xfb\xe9\x9cm\xb2\xf1`\xd4\x9c\xb6\xcc\xe7l\'(\x9aO\x9d\tsT\xaa\xa5\x86\r#\x83\xdf\x87Rk\xaa\x18M\x90\xbbw)6l\x17\xbc3\xd7e\xe9\xbc/\x88*\x13\xf3\xa9\xc1\xf6\x06`\xbdO\xd2\xfa1\xd2\xc0\xa7u$\"\x89\xbc\xe0b\xd1\r$\xde\xd5@i\x18\xa6k,u\xc4?\xe1\xffE\x8a\xe5\xcd\x9f\xecc\x03\x9b\xa5\xa7\xb6j`\xed\xe5\xcc\xda\xbc~\xe7v`\xef#X\xcc\xdf\xf0\"&\x02\x13\x84\xb0\xc25\xf1\x14\xed\x9a\xde\x92vz\xec\xc2V\xac\xde\xb6\x10\xdfB\xe7\x16\x9f$\x03W\xf75\xae_\xe2\x90\x17\xe5\x1e\'%/H\xb9[\xfb\xbb:\x86U5)\x8b\xdc6\xd7\x1d\xb65\xf4\x1cWw\x1d\xb7z\xea\xff\x88?\xeb=\xc3\xcc$\xbd<\x03n9j\xd3\xaf7\x94PX\x83\x9e\x81\"p\xbc@\x90\x1f\xa6T\xe7\xcc2\x92\xa8/\xc8\f7M\xc0qB\xa1\xc2\xe9\xd3\xe2R\x8eO\xda\xc3+\xca\xef\xe9\x10\xeb\xd3\xb9H\xa3\xbf\xeb\xef_\xa8\xd8$s\xc7\xfb\xf3\xec', 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) fcntl$notify(0xffffffffffffffff, 0x402, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r3, 0x0, 0x0) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) r4 = syz_open_dev$sndpcmp(0x0, 0x0, 0x0) ioctl$DRM_IOCTL_AGP_INFO(r4, 0x80386433, 0x0) ioctl$KVM_IRQ_LINE_STATUS(0xffffffffffffffff, 0xc008ae67, &(0x7f0000000300)={0x0, 0x1ff}) add_key(&(0x7f0000000440)='pkcs7_test\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffb) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r2, 0x84, 0x1d, &(0x7f0000000000)={0x6, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, &(0x7f0000000040)=0x1c) getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(r4, 0x84, 0x13, &(0x7f0000000080)={r5, 0x7f}, &(0x7f00000000c0)=0x8) getegid() getsockopt$inet_sctp_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) getsockopt$IP_VS_SO_GET_DESTS(0xffffffffffffffff, 0x0, 0x484, 0x0, 0x0) ioctl$TIOCGETD(r4, 0x5424, &(0x7f0000000340)) geteuid() getsockopt$inet_IP_XFRM_POLICY(0xffffffffffffffff, 0x0, 0x11, 0x0, &(0x7f0000000b00)) memfd_create(0x0, 0x0) ioctl$LOOP_CHANGE_FD(0xffffffffffffffff, 0x4c00, 0xffffffffffffffff) sendfile(r3, 0xffffffffffffffff, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r1, 0x84, 0xc, 0x0, 0x0) fcntl$notify(r0, 0x402, 0x22) 12:46:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc018620b, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:23 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:23 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) r2 = syz_open_dev$swradio(&(0x7f0000000000)='/dev/swradio#\x00', 0x1, 0x2) clock_gettime(0x0, &(0x7f00000011c0)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000001100)=[{{&(0x7f0000000180)=@sco, 0x80, &(0x7f0000000740)=[{&(0x7f0000000200)=""/212, 0xd4}, {&(0x7f0000000300)=""/167, 0xa7}, {&(0x7f00000003c0)=""/102, 0x66}, {&(0x7f0000000080)=""/51, 0x33}, {&(0x7f0000000440)=""/19, 0x13}, {&(0x7f0000000480)=""/147, 0x93}, {&(0x7f0000000540)=""/166, 0xa6}, {&(0x7f0000000600)=""/113, 0x71}, {&(0x7f0000000680)=""/185, 0xb9}], 0x9, &(0x7f0000000800)}, 0x4}, {{&(0x7f0000000840)=@hci={0x1f, 0x0}, 0x80, &(0x7f0000000a80)=[{&(0x7f00000008c0)=""/134, 0x86}, {&(0x7f0000000980)=""/210, 0xd2}], 0x2}, 0x920f}, {{&(0x7f0000000ac0)=@ethernet, 0x80, &(0x7f0000000f80)=[{&(0x7f0000000b40)=""/101, 0x65}, {&(0x7f0000000bc0)=""/185, 0xb9}, {&(0x7f0000000c80)=""/74, 0x4a}, {&(0x7f0000000d00)=""/99, 0x63}, {&(0x7f0000000d80)=""/196, 0xc4}, {&(0x7f0000000e80)=""/19, 0x13}, {&(0x7f0000000ec0)=""/148, 0x94}], 0x7, &(0x7f0000001000)=""/245, 0xf5}, 0x22b}], 0x3, 0x10000, &(0x7f0000001200)={r3, r4+30000000}) ioctl$sock_inet6_SIOCDELRT(r1, 0x890c, &(0x7f0000001240)={@loopback, @mcast1, @mcast1, 0xffffffffffff5151, 0x8, 0x9, 0x500, 0x2, 0x80, r5}) ioctl$sock_inet_SIOCSIFBRDADDR(r2, 0x891a, &(0x7f0000000040)={'syzkaller0\x00', {0x2, 0x4e20, @remote}}) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) r7 = dup3(r6, r1, 0x0) setsockopt$inet6_MRT6_DEL_MFC_PROXY(r7, 0x29, 0xd3, &(0x7f0000000100)={{0xa, 0x4e21, 0x4, @mcast2, 0x6}, {0xa, 0x4e1e, 0x4, @rand_addr="165897be8ff0dd51c284cbe0ef0d7de2", 0x100000001}, 0x8001, [0x800, 0xa, 0x1, 0x0, 0xc8d, 0xb, 0xe2bd, 0x1]}, 0x10062) [ 374.489302][T31475] binder: 31471:31475 ioctl c0306201 20000400 returned -14 [ 374.536675][T31482] binder_alloc: binder_alloc_mmap_handler: 31471 20001000-20004000 already mapped failed -16 [ 374.573657][T31481] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 374.586255][T31486] binder: BINDER_SET_CONTEXT_MGR already set [ 374.592890][T31486] binder: 31471:31486 ioctl 40046207 0 returned -16 [ 374.593127][T31482] binder_alloc: 31471: binder_alloc_buf, no vma [ 374.617405][T31482] binder: 31471:31482 transaction failed 29189/-3, size 0-0 line 3147 [ 374.626180][T31482] binder: 31471:31482 ioctl c0306201 20000400 returned -14 12:46:23 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:23 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x406000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:23 executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0xfffffffffffffffe) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000240)=0xfff, 0x4) sendto$inet(r0, 0x0, 0x0, 0x20000806, &(0x7f0000001180)={0x2, 0x4e23, @local}, 0x10) r1 = syz_open_dev$sndpcmp(&(0x7f0000000000)='/dev/snd/pcmC#D#p\x00', 0x200, 0x10000) write$apparmor_current(r1, &(0x7f0000000040)=@hat={'permhat ', 0x2}, 0x1b) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='sit0\x00', 0x10) sendto$inet(r0, &(0x7f00000003c0), 0xed5f0dd4, 0x0, 0x0, 0x184) shutdown(r0, 0x400000000000001) 12:46:23 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc018620c, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 374.633851][ T7660] binder: release 31471:31475 transaction 165 out, still active [ 374.654418][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 374.664545][ T7660] binder: undelivered TRANSACTION_ERROR: 29189 [ 374.675285][ T7660] binder: send failed reply for transaction 165, target dead 12:46:23 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:23 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x406800, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 374.764829][T31521] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 374.791334][T31540] binder: 31528:31540 ioctl c0306201 20000400 returned -14 12:46:23 executing program 4: socketpair$unix(0x1, 0x80000000000003, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$PERF_EVENT_IOC_ENABLE(r0, 0x8912, 0x400200) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000040)='/dev/mixer\x00', 0x14680, 0x0) mq_timedsend(r3, &(0x7f0000000240)="9bd4999c2868d966bf90fac81704db56098ff31f7dee6c35835fc4a1396389b02c300dc37b7b030d94603eb728a915ef34c97c7e440cb2581cceba34462f65f398eac0b16833d6de73cce0d05ccaa765f5cf7b27d307aac91dc7a2a44da933f8f51c6f2483b82a74906c12e5414745a17662644b1cf011d104f3ce03ee859dfa64e45b850e31f1070ffc2d05fe3f014488d39fb68de7d6f0c9a4deb1ea2d04130f389422d7f3025cc10b224ef8776fe8a831e6611b5daae7401314e1b6509a8cbae2ff1b13125cf06e736bde783dc957bc675afbc3c5789f7d7f848313dfd72a8b80f929bf57f84414e42344d82745bc066e8885cb293830a9af615450c5e7c363350c246fe011d1c5fa04d4bf9c84125b43c9f97f321bcdfcc2460b1f5b3211d31cb6212dc704b6c86e8518ec49f792e3969783b7c1d73d52a6969b9d64d3f85cfaa5a92727128e15638995a23773c2c41da2811d42390a84ffb0fc8a1307b9123ace85dfe867b896599df5929ac96ebd8ad920819175cd48e006f18163f19ccc8705a6ce3ae01a3b952675ebedb1b41ba5e16c93b7e6311ae8d166f7bee94f5ae17759f0e443600cb4d3551b84fb23285d41ecdf928c6bea00b8d26eff21fd99f30dc7fcc6a82b3b60008fe9b2d44b88bdd72d28871209f42ae30c308acddfbc3f19bf39a541603aa57f48f5781ca22f000a8bb047e4aff1f5488b987c0accebcb2c79d0cd611ffdcc17a09f84c955dce4d6b1a9e7a77e1bfb9189470a7a10b648eba11f83325ef9a2211a5100f13742a5725901eeba6a34d6b85cec502db3ee75652d0d22833df7612d9ada8c062c8332485df64032fc5731930f6e9e790f975ebacae9f6a8f89b7fc8c700656a1148055a4c744b1deb175bfad7581c4bf69eca4d549b849e0a2d86972e9a9652266548064ab28193fce8f5ca6ca450e14a9edb5649a0699559fefbb92d309e24df1ed5084b619bae6127ae5920ff4f7cf03f9882c5a409071dd7fce5f919b3a0975ffd3e2ab80e98ac1e0963ee1487ad3930e342e55e1a8e2206212fe24c31cf56b25cf6a7a70f960b0418566a75f98b2cdbc322e17eb3a3a5ba144340030865b2fdd22d47d77bb4a13212aecdf039108438dcffe9c406d815f286d90ac6116136771043ae669723b0de7d2535f9282a7db73cce31b1fa33cf4e571a9183310c332176fb315645522cec59b57e60c14f69618f56b83d0811f8f75b0552acf2b1d452605739fc05c4a4bbe28ae72233763d2efe2688137902e65a9d73e62050af2f8c364d051672c1f0b0c32234936d8faf200af22d71c410a860728b6ca31713a668405c738cd9741a59aef743413857361aed5be733c95345bbc5a4ecbbc9bd3a7a19b8035619d64ffddeed675d0b506c1f65a30d649828d342447e4fdcc63bc8de1150d59d454ca90bd78727a0358129382ab6e68beb6fa2bfd86e72ee701cb48a1caf02740b1f8da672e6b2402405fea60b992a0e7fa6ef0132a19780c485994110092871d610cc3fd693099594f01e7691d07d54a7f85d555ec51bad16cb597dc2c77f7896a925c496e3b30d8dfef8fe4defcbfeb76450f904f955022a172c4e3741ff9fe4862df388e54c5d2602671c3e0276bc2f64bd47dcfcdbe7146bb9e3a0582876cee336bc12f95f374d039da4f2635a279ab0b851de5efcc1999a12e16967e96ea4c167d9f482f90b1c27aa04220b466a34d110992176f8a8ab49a03b743acf3350b46ba0b59cfd0807bf5c04c86e5387f42304d6950d88fdb031b5b525af558ef79511c80cb1229fbe10daa4355bf03f339f4aa5c405b8c5c515a0ff41761881394c975019f86dc16b615c4c0ce2530b7b28f78a8b6c0065e0bc65fbe4355238a62cc5f96520b61e2dfdb57d83f6684300f916ed6fb8df3b64eba37b6c38778ceab3fd76abc83b143843a61da0a346321c3b633908d7e6bb7240fcca2c95c646b3599662a7d2e98f13ae50084e20050678fa78b4cd93ac5dbf5d7a7860ed690ee0df433a6c11f604119122f6b1d20922a99d318dd6a47d9144812514a023baa07ac69c12075cbfbe1003fba23721a5f17f9cb8c3de472eebbcf17a0b5c5b084b2ed98cf22408992b1fe9789f61fd4d4835370e09149cbd4db8364c9252cd85c648e4d3c7f9caa0f68d5f52c0a852201a9fa0f6845479553ab364781a00a9e7cab34df8f89c0846f01dfb2f8d5a28a9e1d57e075cf505b4377fa5db75040f386de2cb25d677f3ca0bb54ddbca9ef199eb61796e0a77b4fd7d5af5dcc6ce5893ad8fa904ee75965815bc8d23cd3153c362fc8c73d5e41eb7ac31eccdc3cda2175152aae2d620ba170bc071e6076456a346eda25ac8033e52ae14acef60127691dc16443a4e47d628404dded40b48dd4111073d35a10087be0dcf6b0fe4bd314b9fccce61c7718ab10b903c7f73036b227204cac0a00b5d5fe9d53d5132e437c08a78ad9040a82ba455ee240eb80dd31837b0eb2069eefff0ae96d8cd19f78a731b2c6cf3210273d30b5155db3ff6adf51f760136b125f58b3a90a041bb2891c0c5db067aea064d8571615e689b2647141b9cc4e6196f95b0f23abd37a4c72a5cfa96411fbdf8f20ebbf7dcaaa3e458962c90e6a1bbe300f17b3c6b030179f480918073427bbb9a54bb8d34991221bf98c64cd94ec8f32d5c1e2a5c8d644449d5fdaf93dd8cce52df230d8e39d9a521ae937a49346e422120f8c8256ccb3cb68f4a72b29bc0e9ba5d7facc92a72567aba91d62d32aa0727128c2bf1594143c06a2cc404b3e16a3c9cf7507689b088046367db2f086a9f5845244b8c07ac09cab1d5cb9a2c6772f5ec72972545a053ea3e3984f1625dd4548864b3689d6ea676e1f817f3268c7be5040240b9ce7eeb01ac1db95dfacac57f05188c77697b63b04d6fe613133e0ee4b39c3e8b4279dccd82406293c9593135394163dc69c4f72e9242f429b60b2208c1d0dcb25c99a115739231a54a3359b540c6f1436ffd71691fde1164ae9a8584f67edb8f2bab539a0e1f3276f796f510d4071f064f9abc09894b1344d2ebd03a1e79195aeae78ded2baa7cb7efd39282895fc9e8033de8dd8e915ea01fac610d2cd645a3f00bbdd6a2f0c4e1bc1374e637b8748990f8cbe927493bda1ba741603dcf1a4fbf8b94072266b837d998ff21e8cee41e395653a056b612be062924b663069632936b02ad119f78266330a6c4a3011f87855716e4c7547dbf3fa934fc95d6428873e54ce787e8364c9427143af2d36d4f9e8caf36a178ec1b256b54778b96550bea6de685225139a6b31f9c6dce89d990be27b09d57fbeef2d47284d68b2766719577971066422e1592a50b13b657a8a9cb542315319ffe25c74da72dc1921ccd8365aa668896e04816d49010bf861e1c4a533d145fea26ad61fde47a82366688a176e1d0242510fa5e4181812d583650feb212e9e8c2eb9b74e8c5a13e803b738ce7957f0a1f78005b03ac5288694149a569ff3d682363065d78adc8a1c5ec0e9bb2b763b074238aa30fd59d7e672ca7b303d56904d1fa96c3a7eadf44f65c1df7df780233d0ff462c494a44ae2c2c02fed02291f7835114e64cea04434fcb49fadcd2d0769d82af6947d14689c1c79cc9b7a6b6134cecea2dff63b132424af6002691139e7da8f585c5c39a9cd7225cb7f338985aedec650e261489e066ae1f301111eed6dcec5050a9c60d3a3f9003df3bee79097d3655a20e8a0f15f6117728b756cf33eafdf8ef8ccdac464d098548e615f8d66fa9f38724b844acfd1261952721c055c27ef00692331ebce512d04c99a47413194ec605814a4252090b93e9a0c7857c1a6736cece9e066830c4ab71fe50b45d1b84279be087a3d064f86df5f8030e5d9a9a5a9d528881d0c1cc3ca958bb40afc4b9f5767449f31697c2178f41f100148189ea69562a733e0ddf605be0bd079392701ff28d56771af4d01c0ebba6c481bb640d275a3322bcb8d85b41c5c6f91ab2789d57aba70e16a41087275ebfc81dcc83c6822c204c7f1660834d53c7e7c9b03bae1eaa7b27a03209b6c8baa04937d2145095b5eab78affed347647f6d943549c2cfa84a55ce47dc703e92c2376623fc9ca7cb7487ce38346b004d8edf8481f062363440458439b59f4f22e6b38490f155d12239187cd858ed08846c479bb44b553628b69be452257a747e4a90ab7412fe16c1094009afab3d7e80cb5f9257a3f2e8375fc5f9884fd47101b65d94b3e649afb2bf0472aee8043c0320d63f98347fb5882cd0bb736496db28b28e066bfbe1737f7f5764c4de8c1c9a22bd9c3001cfdd22ff768f47a816c47f05fc7260c92cb229fe0dfe15c3e75860df90ee7e5c2c185d523d4e8a9c6740ef929766e3d3c1bad2d482576424bc48afcc8c39a1762466d6c0b6542db345863c555fbb8c9f668f769ee2a53cc350886ea4b98cc88e6fa9c80b92e065649e71048186d77c5040673cccb2f1dab1991bb8fe336c24f29f6c9e0687abf2d7a46d795ec8b76f0148be827dea12f65f710e72bc7c6263675248326ac71ed7ca4bfe29a359b56a79505fc2998a3fdd62537e3365eb287ed97d1eff620a9f7ab72db8e3fdce8e323732fbb502242aca20a452d26133b48f431ebbeb4709d453c4f166ae2f2632678734e8e8ba089f1ca06960757003cfab486c4988239488057e1d1619128a7f32a36eacc71355f98b825f26a98a5bde3ab332eacaa42b043dac9336e891c56a9814060140e56f395b4e570ccc939d93a2733b38ff6205ebd3959db057bfddd452302cc9c98e04973223b8f3820cde98d28e9e9f54ee0091f23e943c32dafcd5331960e54cfa376e6dfb28badd642321fef635bb11adbe2d32d3340f07a5700034515ac22ea2ce89120b1c7999e7db53bb29f3335644e7ed3391cbfcb8874fe993a860bd96ede3771dab01b06d87378eff2d38f8aa2857c21c4d90e6306adc1f151b813883773032c3e5c76b37b382508ea46d773c0a865de0596fc74995e5d4a5e51440e503b3d23d30dd85c2f5bada8dbcbd6d9f74ae6ab48724e7bb061b77e2995f2d52c83d343332ecade178a4d223359ba60c8d1cde496ff360ecf72f0fb47452e599df16c9fc41d8a657bed16d9f17d99e2e11a0e2ade2298fbf5aa9f99f93e6aaa856d6caca5fa237d3155c0dd6121d4fb9400d4c4f58e838097e8f3f520f40c88d52dc2655e986f51bd3c96b216f31ce378a48b1fad53c084d74db16f5c0a1188f94051251ff2bd3db83ef218668c83192e506fc4c578148def99357f321a979d248fa14b0941a3aa162040878034238c929ce58dbac2c1641f45ea3ef3f9475b56d1a3283a56959d463d70101b4782f3f1b23230a784330c9f07af151d752ffe5261d8cbd6167e273b5f8493c082d46bbbc228b9c892ef7292cab1543de1c8ff719b47bcd17f5585d962e9a515fa84e9f5d67a7fb50ebc0abbff6e719562150a820b7d6feedb2d5c220abbe52c3304e3ca3a36a9efda886c57df148e4d3f0b25826b0bd9307429effb31a45420bed7ece4cdedc48d775bb4a5d848eb144cee4630f4998deae8f81c2655cb9e294ea0b6cb86709c2e9106f96e13e518f376072b3a6b3a40051e1f8abeb088d8a20f9a07a958fd8a7efaf8383b9583161a32291bf978c491ff55b0355ad8265e691b10e57e2dafc5344d05d059e474721e8e89f22f0983c43f466f98a75164daa24faa613638a4d15b7b460ff54740b626c76a6d20d94352e16e1ed189554361b551ab934cd13511e796e206", 0x1000, 0x5, &(0x7f00000000c0)={0x0, 0x989680}) setsockopt$inet_sctp_SCTP_EVENTS(r3, 0x84, 0xb, &(0x7f0000000080)={0x10000, 0x10000, 0xfff, 0x4, 0x1, 0x4, 0x3, 0xc44, 0xb7, 0x0, 0x3}, 0xb) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) rseq(&(0x7f0000000140), 0x20, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffffe2, 0x0, 0x0, 0x0) [ 374.830289][T31540] binder: 31528 BINDER_GET_NODE_INFO_FOR_REF: only handle may be non-zero. [ 374.830301][T31540] binder: 31528:31540 ioctl c018620c 20000040 returned -22 [ 374.911544][T31608] binder_alloc: binder_alloc_mmap_handler: 31528 20001000-20004000 already mapped failed -16 [ 374.930126][T31605] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 374.947831][T31608] binder_alloc: 31528: binder_alloc_buf, no vma [ 374.948816][T31540] binder: BINDER_SET_CONTEXT_MGR already set [ 374.959555][T31608] binder: 31528:31608 transaction failed 29189/-3, size 0-0 line 3147 [ 374.977387][T31608] binder: 31528:31608 ioctl c0306201 20000400 returned -14 [ 374.987322][ T7669] binder: release 31528:31540 transaction 168 out, still active [ 375.005664][T31540] binder: 31528:31540 ioctl 40046207 0 returned -16 [ 375.012750][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 375.022098][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 375.042421][ T7669] binder: send failed reply for transaction 168, target dead 12:46:24 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x406c00, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:24 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:24 executing program 4: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x406800, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0189436, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:24 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) r2 = syz_open_dev$radio(&(0x7f0000000140)='/dev/radio#\x00', 0x1, 0x2) setsockopt$SO_RDS_TRANSPORT(r2, 0x114, 0x8, &(0x7f0000000180)=0xffffffffffffffff, 0x4) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) ioctl$EXT4_IOC_SWAP_BOOT(r0, 0x6611) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = add_key$user(&(0x7f0000000000)='user\x00', &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000080)="6b5e88a71c90b18c5a3246e9c6da522af8ec73c06e853226f3f450f8ca944d107cc1138c89f9584050edd6b29e034c7c454d34978bdfae2eb8e985dffa3826", 0x3f, 0xfffffffffffffffa) keyctl$update(0x2, r4, &(0x7f0000000100)="68933f8923e730b77c1b321de2b428ea09ba5a338fadda63cebe126d7244", 0x1e) dup3(r3, r1, 0x0) 12:46:24 executing program 2: prctl$PR_GET_ENDIAN(0x13, &(0x7f0000000140)) r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x100, 0x0) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r2, 0x84, 0x12, &(0x7f0000000000), 0x4) getsockopt$packet_int(r2, 0x107, 0xe, &(0x7f0000000280), &(0x7f00000002c0)=0x4) read(r0, &(0x7f0000000180)=""/223, 0xdf) getsockopt$sock_linger(r2, 0x1, 0xd, &(0x7f0000000300), &(0x7f0000000340)=0x8) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 375.370338][T31723] binder: 31722:31723 ioctl c0306201 20000400 returned -14 [ 375.398906][T31725] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:24 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 375.430843][T31726] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 375.445586][T31723] binder: BINDER_SET_CONTEXT_MGR already set [ 375.465279][T31734] binder: 31722:31734 ioctl c0306201 20000400 returned -14 12:46:24 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) mq_unlink(&(0x7f0000000000)=',^keyring\x00') setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) 12:46:24 executing program 4: r0 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = memfd_create(&(0x7f00000028c0)='/deV/\x00\xe1\xb1c$I\xd0](\x10\xbbZ\x19\xd0\x14\x96}%\xed\x85\xb1YT\x9c\xf8@f\xa0\xd0G\x10-,\xc3+\xb8i\xc0\xaf\xbf\xfc\x99\x95\x835\xab\xeaH\b\"\x82\x82\x7f:k\xfe\xeb\x97\xd1\xbb&I\xe8\xf9\xe0\xab^\xbb\xbeY\xbf\x9f\xe3\xa5\xae\xfc\x93\xe2\xcfC\x8f\x89\xcbqB\x90a\xd3o8\xb1\xfa\xae\xe6\xb2\xaf\xfb\x1a\x10\xd5\x82\xb1$Q\x8c\x13\x9b\xc7z\xecM\x00\x01z\x8f\xdb\xb4\x82\x05S[\x85\xd9c\x16\x8dg?\x91y\xd3\xffN\xe9\x8bg\xe7\xfe<\xca#`(\xf5\xa7\x05\xc7\x12W\x94\xbc;\'\x1a\xa2\b)\x1a\xec\xec_i\xb8F\xb0\x06\x00bG\xb1\xbb\xdfx\xf8\x98\xda@\xe5M\xd0\xe4\xf0\x01V\x11/\xfa\x83\xe6^\xf0XfT\x90\xb1&D\xd1\x16a\x99\a#\xa5#\xbb\x99Fp\x92\x03\xcf\x8f\x85i\x81\xb1\x9e\x9a\a\x95\x17\xd84YT\f)\x1aSD\x19\x9d\x0e\x99!\x87\xe2?\xf2j\xfcS\xcb%C\x9b\xf8\x93\xd17\xf1\x97G\xa0g\xb5\xde\x1a\xc7\x83\xc1\x17\xcc\xd8\xf4\x15\xe5\x0e\xa7\x91N\xa3\x93\xe5&H\x7f\x1d\xd9\xa8)', 0x0) ftruncate(r2, 0xfffffd) sendfile(r1, r2, &(0x7f00000037c0)=0xf10001, 0xfffffdef) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040)='TIPCv2\x00') sendmsg$TIPC_NL_MEDIA_GET(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0xf4, r3, 0x400, 0x70bd26, 0x25dfdbfb, {}, [@TIPC_NLA_NODE={0x4}, @TIPC_NLA_BEARER={0x7c, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x5}, @TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e23, 0x2, @remote, 0xff}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x8, @remote, 0x7}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @broadcast}}, {0x14, 0x2, @in={0x2, 0x4e24, @broadcast}}}}]}, @TIPC_NLA_NODE={0x14, 0x6, [@TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}]}, @TIPC_NLA_MON={0x4c, 0x9, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x16c6}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x80000000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0xffffffffffffffe1}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x401}]}]}, 0xf4}}, 0x20000000) 12:46:24 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 375.480381][T31723] binder: 31722:31723 ioctl 40046207 0 returned -16 12:46:24 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x407400, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:24 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc020660b, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:24 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:24 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = dup3(r2, r1, 0x0) clock_settime(0x4, &(0x7f0000000000)={0x0, 0x1c9c380}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r3, 0xc04c5349, &(0x7f0000000040)={0xdb, 0x6, 0x7}) [ 375.684279][T31756] binder: 31754:31756 ioctl c0306201 20000400 returned -14 [ 375.691765][T31755] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 375.732942][T31791] binder_alloc_mmap_handler: 1 callbacks suppressed [ 375.732957][T31791] binder_alloc: binder_alloc_mmap_handler: 31754 20001000-20004000 already mapped failed -16 [ 375.761717][T31756] binder: BINDER_SET_CONTEXT_MGR already set [ 375.768103][T31756] binder: 31754:31756 ioctl 40046207 0 returned -16 12:46:24 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x407a00, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:24 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 375.783877][T31791] binder_alloc_new_buf_locked: 1 callbacks suppressed [ 375.783884][T31791] binder_alloc: 31754: binder_alloc_buf, no vma [ 375.810834][T31791] binder_transaction: 1 callbacks suppressed [ 375.810848][T31791] binder: 31754:31791 transaction failed 29189/-3, size 0-0 line 3147 [ 375.817768][T31791] binder: 31754:31791 ioctl c0306201 20000400 returned -14 12:46:24 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") ioctl$sock_SIOCADDDLCI(r0, 0x8980, &(0x7f0000000040)={'veth0_to_team\x00', 0xfffffffffffffff9}) r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = dup3(r2, r1, 0x0) r4 = fcntl$getown(r3, 0x9) fcntl$lock(r1, 0x26, &(0x7f0000000000)={0x0, 0x4, 0x5578, 0xffffffff, r4}) [ 375.867796][ T7660] binder_release_work: 1 callbacks suppressed [ 375.867802][ T7660] binder: undelivered TRANSACTION_ERROR: 29189 [ 375.943533][T31869] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:25 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) modify_ldt$read_default(0x2, &(0x7f0000000280)=""/166, 0xa6) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306202, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:25 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:25 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x800100000000b, 0x8002f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) 12:46:25 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x40f600, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:25 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vga_arbiter\x00', 0x50000, 0x0) r2 = add_key$user(&(0x7f0000000740)='user\x00', &(0x7f0000000880)={'syz', 0x1}, &(0x7f00000002c0)='X', 0x1, 0xfffffffffffffffe) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) r3 = add_key$user(&(0x7f0000000640)='user\x00', &(0x7f0000000540)={'syz'}, &(0x7f00000000c0), 0xc6, 0xfffffffffffffffd) r4 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0xffffffffffff8001, 0x40) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r4, 0x84, 0x12, &(0x7f0000000680), 0x4) keyctl$dh_compute(0x17, &(0x7f0000000300)={r2, r3, r3}, &(0x7f0000000080)=""/107, 0x6b, &(0x7f0000000200)={&(0x7f0000000100)={'poly1305-generic\x00'}}) fcntl$getflags(0xffffffffffffffff, 0x401) ioctl$SIOCGSTAMPNS(r4, 0x8907, &(0x7f0000000000)) sysinfo(&(0x7f00000007c0)=""/154) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x11b400, 0x0) ioctl$BLKPG(r0, 0x1269, &(0x7f00000006c0)={0x1, 0x0, 0x0, &(0x7f0000000800)}) connect$unix(0xffffffffffffffff, &(0x7f0000000240)=@abs={0x1}, 0x6e) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x41, 0x0, 0x0) ioctl$TCXONC(r5, 0x540a, 0x8) ioctl$IOC_PR_PREEMPT(r5, 0x401870cb, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000d80)=ANY=[@ANYBLOB="73656375726974790000000000000000000000000000000000000000000000009f00000018029ea690858bfb92c4925e59511d2128a26cae33f48d67b991621df63e050000000000006fb1cf1f353403e8df243529848fc1c7e807f2889a8aeda146e9c9a8ce6ad1a0a4b9de624c47f7837459c49f9f888d2705c886dc49d79c50731b87fb47babed83fbad8ac5119c18f5909e69eeb39a623e4b9c7e95df08502364c64f024ad67e0fd9d1ecdc1eaa681ef0ce5bf93a03c5f9cc2d545da96849f1caa56535b03d5eaac5be99d0cf878a2f27b2ca0f3fd4ff125ccb108cc3516f825a40f69e4c4d63a140f98c3b7faa00cbb7612a1a84154c57eb607269da63aca837959e6c873d8637ba62f81248a1602161c4b1069dcfec27ec68a71af3b193c0936938c22d2222edc2d9e83fb51b3db917c08f3d5fa87aca5f7a2ea9b3ccf9dccf6326b5a0854bc6ed6c443592e5bd71fbd43f37e198410039efc69839720434be3024b0f57294312fb894fafc019e9b60780bcdcf131d3ca610605b68697be44fe06cdb435daf6bc59daa64322da87fb3e64033b89757bc95cfbb235148a3b4934f299cda559cc2fe1e5835b8eca4b3b0bdb22e1f53caf14478f9c0975788d0bd36073e9ffbe0bb91d6ce157e12b2d28da03098cbca7aebdce6457375a3951b423c7e302a93c4dd1e8e8c4b0c285966437dbae651b888993fc1a033d5648ae24d9fecab992b0a66b7610b66cbdbfdc5e2ae38939a949f675e616588fb204718c4f5cbc002cb5511fec1ceb260d904fe1dee00d6dc704591dc344a19b49f4d77052b718b9056747a909862f"], 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x13, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r5, 0x660c) ioctl$IOC_PR_RELEASE(r1, 0x401070ca, &(0x7f0000000400)={0x200, 0x7}) gettid() r6 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) request_key(&(0x7f0000000040)='big_key\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000340)='/dev/vga_arbiter\x00', r6) write$cgroup_int(0xffffffffffffffff, &(0x7f00000005c0)=0x100, 0x12) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, 0xffffffffffffffff, &(0x7f0000000480)={0x8}) request_key(&(0x7f0000000200)='dns_resolver\x00', &(0x7f0000000180)={'sy.'}, 0x0, 0xffffffffffffffff) connect$inet6(r1, 0x0, 0xaed4580b) [ 376.263923][T31888] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 376.279579][T31893] binder: 31883:31893 ioctl c0306201 20000400 returned -14 12:46:25 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x7ffffffff000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:25 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="b64920f40d6089916892916b3bcb5cc65492fdc19ab56acb30fea71ed87f12032ad885dd87d4b21f3bd5488cead916b8647118eb8323b4e43e38f3cd8f3d53e7e96deaef6fd0011c1400a8886936b7c5b366a3da301c17c157ad7eee6d3b50cf670db69657312a382c1a716ffb707042247964d918ee190b0754158435416675a94a19a5a0de1d34da7a560273653873012a1abc220be0f7e012") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x8000, 0x10000) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f0000000100)) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r1, &(0x7f0000000240)={0x2}) ioctl$FS_IOC_GETFLAGS(r1, 0x80086601, &(0x7f0000000280)) dup3(r2, r1, 0x0) 12:46:25 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 376.323966][T31893] binder: 31883:31893 ioctl c0306202 20000040 returned -22 [ 376.387000][T31919] binder_alloc: binder_alloc_mmap_handler: 31883 20001000-20004000 already mapped failed -16 [ 376.429571][T31893] binder: BINDER_SET_CONTEXT_MGR already set [ 376.429591][T31919] binder_alloc: 31883: binder_alloc_buf, no vma 12:46:25 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000000)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_SET(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x18, r3, 0x1, 0x0, 0x0, {}, [@TIPC_NLA_LINK={0x4}]}, 0x18}}, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:25 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='\nverlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:25 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = openat$proc_capi20ncci(0xffffffffffffff9c, &(0x7f0000000080)='/proc/capi/capi20ncci\x00', 0x8000, 0x0) ioctl$UI_SET_EVBIT(r1, 0x40045564, 0x2) r2 = socket$inet6(0xa, 0x7, 0x1) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r3, r2, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x2, 0x0) ioctl$CAPI_SET_FLAGS(r3, 0x80044324, &(0x7f0000000000)) [ 376.466197][T31919] binder: 31883:31919 transaction failed 29189/-3, size 0-0 line 3147 [ 376.472513][T31893] binder: 31883:31893 ioctl 40046207 0 returned -16 [ 376.482069][T31919] binder: 31883:31919 ioctl c0306201 20000400 returned -14 12:46:25 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 376.583860][T31893] binder: 31883:31893 ioctl c0306202 20000040 returned -22 [ 376.640025][ T7660] binder_thread_release: 2 callbacks suppressed [ 376.640035][ T7660] binder: release 31883:31893 transaction 177 out, still active 12:46:25 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306203, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:25 executing program 4: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000200)='/dev/loop#\x00', 0x0, 0x0) r1 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000580)='/dev/vga_arbiter\x00', 0x50000, 0x0) r2 = add_key$user(&(0x7f0000000740)='user\x00', &(0x7f0000000880)={'syz', 0x1}, &(0x7f00000002c0)='X', 0x1, 0xfffffffffffffffe) openat$audio(0xffffffffffffff9c, &(0x7f0000000140)='/dev/audio\x00', 0x0, 0x0) r3 = add_key$user(&(0x7f0000000640)='user\x00', &(0x7f0000000540)={'syz'}, &(0x7f00000000c0), 0xc6, 0xfffffffffffffffd) r4 = syz_open_dev$usb(&(0x7f0000000600)='/dev/bus/usb/00#/00#\x00', 0xffffffffffff8001, 0x40) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r4, 0x84, 0x12, &(0x7f0000000680), 0x4) keyctl$dh_compute(0x17, &(0x7f0000000300)={r2, r3, r3}, &(0x7f0000000080)=""/107, 0x6b, &(0x7f0000000200)={&(0x7f0000000100)={'poly1305-generic\x00'}}) fcntl$getflags(0xffffffffffffffff, 0x401) ioctl$SIOCGSTAMPNS(r4, 0x8907, &(0x7f0000000000)) sysinfo(&(0x7f00000007c0)=""/154) r5 = openat$zero(0xffffffffffffff9c, &(0x7f0000000140)='/dev/zero\x00', 0x11b400, 0x0) ioctl$BLKPG(r0, 0x1269, &(0x7f00000006c0)={0x1, 0x0, 0x0, &(0x7f0000000800)}) connect$unix(0xffffffffffffffff, &(0x7f0000000240)=@abs={0x1}, 0x6e) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x0, @dev}, 0x10) getsockopt$IPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x41, 0x0, 0x0) ioctl$TCXONC(r5, 0x540a, 0x8) ioctl$IOC_PR_PREEMPT(r5, 0x401870cb, 0x0) getsockopt$IP6T_SO_GET_ENTRIES(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000d80)=ANY=[@ANYBLOB="73656375726974790000000000000000000000000000000000000000000000009f00000018029ea690858bfb92c4925e59511d2128a26cae33f48d67b991621df63e050000000000006fb1cf1f353403e8df243529848fc1c7e807f2889a8aeda146e9c9a8ce6ad1a0a4b9de624c47f7837459c49f9f888d2705c886dc49d79c50731b87fb47babed83fbad8ac5119c18f5909e69eeb39a623e4b9c7e95df08502364c64f024ad67e0fd9d1ecdc1eaa681ef0ce5bf93a03c5f9cc2d545da96849f1caa56535b03d5eaac5be99d0cf878a2f27b2ca0f3fd4ff125ccb108cc3516f825a40f69e4c4d63a140f98c3b7faa00cbb7612a1a84154c57eb607269da63aca837959e6c873d8637ba62f81248a1602161c4b1069dcfec27ec68a71af3b193c0936938c22d2222edc2d9e83fb51b3db917c08f3d5fa87aca5f7a2ea9b3ccf9dccf6326b5a0854bc6ed6c443592e5bd71fbd43f37e198410039efc69839720434be3024b0f57294312fb894fafc019e9b60780bcdcf131d3ca610605b68697be44fe06cdb435daf6bc59daa64322da87fb3e64033b89757bc95cfbb235148a3b4934f299cda559cc2fe1e5835b8eca4b3b0bdb22e1f53caf14478f9c0975788d0bd36073e9ffbe0bb91d6ce157e12b2d28da03098cbca7aebdce6457375a3951b423c7e302a93c4dd1e8e8c4b0c285966437dbae651b888993fc1a033d5648ae24d9fecab992b0a66b7610b66cbdbfdc5e2ae38939a949f675e616588fb204718c4f5cbc002cb5511fec1ceb260d904fe1dee00d6dc704591dc344a19b49f4d77052b718b9056747a909862f"], 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x0, 0x13, 0xffffffffffffffff, 0x0) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r5, 0x660c) ioctl$IOC_PR_RELEASE(r1, 0x401070ca, &(0x7f0000000400)={0x200, 0x7}) gettid() r6 = add_key$keyring(&(0x7f0000000380)='keyring\x00', &(0x7f00000003c0)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) request_key(&(0x7f0000000040)='big_key\x00', &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000340)='/dev/vga_arbiter\x00', r6) write$cgroup_int(0xffffffffffffffff, &(0x7f00000005c0)=0x100, 0x12) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, 0xffffffffffffffff, &(0x7f0000000480)={0x8}) request_key(&(0x7f0000000200)='dns_resolver\x00', &(0x7f0000000180)={'sy.'}, 0x0, 0xffffffffffffffff) connect$inet6(r1, 0x0, 0xaed4580b) 12:46:25 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:25 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='%verlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 376.697708][ T7660] binder_release_work: 2 callbacks suppressed [ 376.697714][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 376.755628][ T7660] binder: undelivered TRANSACTION_ERROR: 29189 [ 376.791978][ T7660] binder_send_failed_reply: 2 callbacks suppressed [ 376.791985][ T7660] binder: send failed reply for transaction 177, target dead 12:46:25 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r1, &(0x7f0000000280)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000000100)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000088f000/0x2000)=nil, 0x2000}) [ 376.849272][T32049] binder: 32048:32049 ioctl c0306201 20000400 returned -14 12:46:25 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = open(&(0x7f0000000040)='./file0\x00', 0x208000, 0x10) getsockopt$inet6_mreq(r1, 0x29, 0x1f, &(0x7f0000000080)={@mcast1}, &(0x7f0000000100)=0x14) r2 = socket$inet6(0xa, 0x0, 0x3f) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) getsockopt$inet_sctp_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f00000003c0)={0x1, [0x0]}, &(0x7f0000000400)=0x8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) r4 = dup3(r3, r2, 0x0) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x1f, &(0x7f0000000140)={0x0, @in6={{0xa, 0x4e22, 0x13, @mcast1, 0x8000}}, 0x1f}, &(0x7f0000000200)=0x90) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r4, 0x84, 0x72, &(0x7f0000000240)={r5, 0x8}, &(0x7f0000000280)=0xc) setsockopt$inet_sctp_SCTP_AUTOCLOSE(r4, 0x84, 0x4, &(0x7f0000000000)=0x3, 0x4) 12:46:25 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:25 executing program 4: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f0000000000)="b64920f40d6089916892916b3bcb5cc65492fdc19ab56acb30fea71ed87f12032ad885dd87d4b21f3bd5488cead916b8647118eb8323b4e43e38f3cd8f3d53e7e96deaef6fd0011c1400a8886936b7c5b366a3da301c17c157ad7eee6d3b50cf670db69657312a382c1a716ffb707042247964d918ee190b0754158435416675a94a19a5a0de1d34da7a560273653873012a1abc220be0f7e012") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = syz_open_dev$dspn(&(0x7f00000000c0)='/dev/dsp#\x00', 0x8000, 0x10000) ioctl$LOOP_GET_STATUS64(r3, 0x4c05, &(0x7f0000000100)) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r1, &(0x7f0000000240)={0x2}) ioctl$FS_IOC_GETFLAGS(r1, 0x80086601, &(0x7f0000000280)) dup3(r2, r1, 0x0) [ 376.904154][T32054] binder: 32048:32054 ioctl c0306203 20000040 returned -22 12:46:26 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)=',verlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 376.974517][T32054] binder_alloc: binder_alloc_mmap_handler: 32048 20001000-20004000 already mapped failed -16 [ 377.019078][T32049] binder: BINDER_SET_CONTEXT_MGR already set [ 377.044043][T32049] binder: 32048:32049 ioctl 40046207 0 returned -16 12:46:26 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:26 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000400)=""/19) r5 = socket$inet(0x2, 0x3, 0x2) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r6, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r6, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r7, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r7, 0x28, 0x0, &(0x7f0000000100)=0x4, 0xfffffffffffffdf5) setsockopt$inet_int(r5, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) dup2(r3, r3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000240)) r8 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') openat$vnet(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-net\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f00000004c0)={0xc, 0x8, 0xfa00, {&(0x7f0000000280)}}, 0x1ac) pwritev(r8, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) name_to_handle_at(r3, &(0x7f0000000040)='./file0\x00', &(0x7f0000000980)=ANY=[@ANYBLOB="670000007f000000fc3960ed64350a35f472dda32b5070c45a6b7bdc33ddefe41b202b9cd214bf38ad2ebaf5439debbd5ed7305b882b8e3dd8d5b7c6bdeec403ca74b6562909c6f7ceb71b519de0bd353f94dbc60c2b00f882b993c93f5c0dd26784a3d9568b56018d634ea93a5de68fa2da802097ca11ebcc616ff8d1c0e0d0b3018000000000000089db0761712d1caf9a69816ce4938d4826fc5955d1598b24ee9c15e8ddb2fd13e336720e819d3e1b9c20f5f7357f0ad40d88c0372c1e64edea962afcbb52b7c9e4b82c781fa3d3aabee9f7bbaad8181b797151bc450897dd7bcf8328c069f6393801e0a20645dccbc6b6c96ba1061ea01638ccab599a348e90f7dbfaf9930097462b3902546393bf48a81d57f86932923bf42b6e48a8b421c439237ae612094835af24dfb06a8c5d2846ab3bbff8db1e05b89165713d1626555fb5475a032b75abd56b72897583b14e814307518e670bb4f8e5a7bbaea129234ca6ce59ff2c544fdb5d4defa4d2db65f86ba0de682c7801e4448121669ff1fdf2682ab969ea264cae72ce8b0961a2a03a0d57dd2ddbe686108d3109ee99d4842835c0e4d44d40ec8d85b0a49aec65941991d48f85077d24f32a665f3014f0bb8af4578e4c565d3eb39b2aa7cd7d824c5cd4b4db1854e7bac7ed2d81336d84cda195e2eb34cb0eaa2aa21c1adc72"], 0x0, 0x1400) [ 377.101128][T32077] binder_alloc: 32048: binder_alloc_buf, no vma [ 377.126245][T32077] binder: 32048:32077 transaction failed 29189/-3, size 0-0 line 3147 12:46:26 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='/verlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 377.148195][T32049] binder: 32048:32049 ioctl c0306203 20000040 returned -22 [ 377.163746][T32077] binder: 32048:32077 ioctl c0306201 20000400 returned -14 [ 377.208291][ T7669] binder: release 32048:32049 transaction 180 out, still active [ 377.221745][ T7669] binder: undelivered TRANSACTION_COMPLETE 12:46:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306204, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:26 executing program 3: socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$inet_udplite(0x2, 0x2, 0x88) shmget(0x0, 0x2000, 0x9, &(0x7f0000ffb000/0x2000)=nil) ioctl(r0, 0x1000008913, &(0x7f0000000000)="0adc1f123c123f3188b0706b452e3f621af69dd85669be5a24cf3abeb57fe0ebb983ebcba514f10cba270ca0af2c59cbb497ca4f9562214e76220fab06e6b188e1c1e65b311bd44393e05a1f12d0eeca145a6463e80c76e7c5cf0c7821df7ca16d2b695a4751647f90f81e2e937db89b524662efdb391e4ec6a5784f11af8ddda6931a6cede04bd58ba5f0a2466039d0515e82233ce3eb43c7b592caf00127b69be01275d648b4c088eaa5dc1ba9bc630e1236dbf0fb137a3be11510986f0ed70d0888639168601d7699ae5e952ac3d6240ee76d0d983df0f7dd8cab35ef7bdab2deea4140e8925befe389e6da8463520a8114d8874f5ac5ac0000") r1 = socket$inet6(0xa, 0x80012, 0x20007) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) setxattr$security_ima(&(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000140)='security.ima\x00', &(0x7f0000000180)=@v1={0x2, "f28b8e271a22"}, 0x7, 0x1) dup3(0xffffffffffffffff, r1, 0x2000080000) 12:46:26 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 377.249132][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 377.275593][ T7669] binder: send failed reply for transaction 180, target dead 12:46:26 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='\\verlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 377.388650][T32099] binder: 32093:32099 ioctl c0306201 20000400 returned -14 [ 377.399831][ C0] net_ratelimit: 22 callbacks suppressed [ 377.399839][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 377.411285][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 377.414867][T32099] binder: 32093:32099 ioctl c0306204 20000040 returned -22 [ 377.449247][T32165] binder_alloc: binder_alloc_mmap_handler: 32093 20001000-20004000 already mapped failed -16 [ 377.523113][T32099] binder: BINDER_SET_CONTEXT_MGR already set [ 377.544329][T32099] binder: 32093:32099 ioctl 40046207 0 returned -16 [ 377.547585][ T7669] binder: send failed reply for transaction 183 to 32093:32099 [ 377.558807][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 377.568912][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 12:46:26 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x4, 0x2c) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = dup3(r2, r1, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000)='/dev/snapshot\x00', 0x8c00, 0x0) setsockopt$inet6_MRT6_ADD_MIF(r3, 0x29, 0xca, &(0x7f0000000040)={0xa21, 0x1, 0x1000, 0xca2, 0xbe78}, 0xfffffecd) ioctl$RTC_AIE_ON(r3, 0x7001) socket$netlink(0x10, 0x3, 0xf) 12:46:26 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:26 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306205, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:26 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000400)=""/19) r5 = socket$inet(0x2, 0x3, 0x2) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r6, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r6, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r7, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r7, 0x28, 0x0, &(0x7f0000000100)=0x4, 0xfffffffffffffdf5) setsockopt$inet_int(r5, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) dup2(r3, r3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000240)) r8 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') openat$vnet(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-net\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f00000004c0)={0xc, 0x8, 0xfa00, {&(0x7f0000000280)}}, 0x1ac) pwritev(r8, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) name_to_handle_at(r3, &(0x7f0000000040)='./file0\x00', &(0x7f0000000980)=ANY=[@ANYBLOB="670000007f000000fc3960ed64350a35f472dda32b5070c45a6b7bdc33ddefe41b202b9cd214bf38ad2ebaf5439debbd5ed7305b882b8e3dd8d5b7c6bdeec403ca74b6562909c6f7ceb71b519de0bd353f94dbc60c2b00f882b993c93f5c0dd26784a3d9568b56018d634ea93a5de68fa2da802097ca11ebcc616ff8d1c0e0d0b3018000000000000089db0761712d1caf9a69816ce4938d4826fc5955d1598b24ee9c15e8ddb2fd13e336720e819d3e1b9c20f5f7357f0ad40d88c0372c1e64edea962afcbb52b7c9e4b82c781fa3d3aabee9f7bbaad8181b797151bc450897dd7bcf8328c069f6393801e0a20645dccbc6b6c96ba1061ea01638ccab599a348e90f7dbfaf9930097462b3902546393bf48a81d57f86932923bf42b6e48a8b421c439237ae612094835af24dfb06a8c5d2846ab3bbff8db1e05b89165713d1626555fb5475a032b75abd56b72897583b14e814307518e670bb4f8e5a7bbaea129234ca6ce59ff2c544fdb5d4defa4d2db65f86ba0de682c7801e4448121669ff1fdf2682ab969ea264cae72ce8b0961a2a03a0d57dd2ddbe686108d3109ee99d4842835c0e4d44d40ec8d85b0a49aec65941991d48f85077d24f32a665f3014f0bb8af4578e4c565d3eb39b2aa7cd7d824c5cd4b4db1854e7bac7ed2d81336d84cda195e2eb34cb0eaa2aa21c1adc72"], 0x0, 0x1400) 12:46:26 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='pverlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:26 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) close(r1) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 377.812913][T32227] binder: 32218:32227 ioctl c0306201 20000400 returned -14 [ 377.844421][T32227] binder: 32218:32227 ioctl c0306205 20000040 returned -22 12:46:26 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 377.879987][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 377.886140][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 377.910420][T32236] binder_alloc: binder_alloc_mmap_handler: 32218 20001000-20004000 already mapped failed -16 12:46:27 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='o\nerlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 377.950196][T32227] binder: BINDER_SET_CONTEXT_MGR already set [ 377.981466][T32227] binder: 32218:32227 ioctl 40046207 0 returned -16 [ 377.998385][ T3486] binder: release 32218:32227 transaction 185 out, still active [ 378.006952][T32236] binder_alloc: 32218: binder_alloc_buf, no vma [ 378.030544][ T3486] binder: undelivered TRANSACTION_COMPLETE [ 378.038765][T32236] binder: 32218:32236 transaction failed 29189/-3, size 0-0 line 3147 12:46:27 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_tcp_TCP_MD5SIG(r1, 0x6, 0xe, &(0x7f00000004c0)={@in={{0x2, 0x4e20, @local}}, 0x0, 0x2, 0x0, "1cf3a309836330d1bdc44fa4b1d5f0426a160a5acbf48d88e7310c06d1a8db746b29080b69beb8b54638b23964a7618d0d92d96af6f6671156b4d1661c0e357c08c90ba258e64bf875ead50a4b0420db"}, 0xd8) r2 = accept4(r0, &(0x7f00000003c0)=@can={0x1d, 0x0}, &(0x7f0000000280)=0x80, 0x80800) getsockopt$TIPC_DEST_DROPPABLE(r2, 0x10f, 0x81, &(0x7f0000000440), &(0x7f0000000480)=0x4) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, r3}, {}, {0x0, 0x0, 0x0, 0x44}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffff9c, 0x89e2, &(0x7f0000000200)={r1}) setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r5, 0x84, 0x12, &(0x7f0000000240)=0x100000000, 0x4) r6 = syz_open_dev$vcsn(&(0x7f0000000100)='/dev/vcs#\x00', 0x5, 0x80000) ioctl$KVM_GET_SUPPORTED_CPUID(r6, 0xc008ae05, &(0x7f0000000140)=""/189) r7 = dup3(r4, r1, 0x0) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r1, 0x84, 0x13, &(0x7f0000000000)={0x0, 0x100000000}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r7, 0x84, 0x1, &(0x7f0000000080)={r8, 0x1f, 0x7, 0x6, 0x7fff, 0x2fca46f}, 0x14) 12:46:27 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 378.048318][ T3486] binder: send failed reply for transaction 185, target dead [ 378.058786][T32236] binder: 32218:32236 ioctl c0306201 20000400 returned -14 [ 378.086788][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 12:46:27 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x0, 0x0) ioctl$VIDIOC_ENUMSTD(r2, 0xc0485619, &(0x7f0000000340)={0x20, 0x0, "a4f0f65b58f88c09731008cecd48d2601057a3177c8bc0a4", {0xf148, 0x7}, 0x7}) write$FUSE_DIRENT(r1, &(0x7f0000000280)={0xa0, 0x0, 0x2, [{0x5, 0x3, 0xb, 0x4, '\xe2GPLvmnet0#'}, {0x0, 0x80000001, 0x3, 0x7876, '#lo'}, {0x5, 0x0, 0x9, 0x400, 'vboxnet0\xbe'}, {0x0, 0x8d, 0x1, 0x3, 'F'}]}, 0xa0) r3 = fcntl$dupfd(r0, 0x0, r1) write$P9_RWALK(r3, &(0x7f0000000100)=ANY=[@ANYBLOB="160000006f02002400a903000000377a2227957b19ee"], 0x16) socket$can_raw(0x1d, 0x3, 0x1) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:27 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000400)=""/19) r5 = socket$inet(0x2, 0x3, 0x2) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r6, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r6, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r7, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r7, 0x28, 0x0, &(0x7f0000000100)=0x4, 0xfffffffffffffdf5) setsockopt$inet_int(r5, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) dup2(r3, r3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000240)) r8 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') openat$vnet(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-net\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f00000004c0)={0xc, 0x8, 0xfa00, {&(0x7f0000000280)}}, 0x1ac) pwritev(r8, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) name_to_handle_at(r3, &(0x7f0000000040)='./file0\x00', &(0x7f0000000980)=ANY=[@ANYBLOB="670000007f000000fc3960ed64350a35f472dda32b5070c45a6b7bdc33ddefe41b202b9cd214bf38ad2ebaf5439debbd5ed7305b882b8e3dd8d5b7c6bdeec403ca74b6562909c6f7ceb71b519de0bd353f94dbc60c2b00f882b993c93f5c0dd26784a3d9568b56018d634ea93a5de68fa2da802097ca11ebcc616ff8d1c0e0d0b3018000000000000089db0761712d1caf9a69816ce4938d4826fc5955d1598b24ee9c15e8ddb2fd13e336720e819d3e1b9c20f5f7357f0ad40d88c0372c1e64edea962afcbb52b7c9e4b82c781fa3d3aabee9f7bbaad8181b797151bc450897dd7bcf8328c069f6393801e0a20645dccbc6b6c96ba1061ea01638ccab599a348e90f7dbfaf9930097462b3902546393bf48a81d57f86932923bf42b6e48a8b421c439237ae612094835af24dfb06a8c5d2846ab3bbff8db1e05b89165713d1626555fb5475a032b75abd56b72897583b14e814307518e670bb4f8e5a7bbaea129234ca6ce59ff2c544fdb5d4defa4d2db65f86ba0de682c7801e4448121669ff1fdf2682ab969ea264cae72ce8b0961a2a03a0d57dd2ddbe686108d3109ee99d4842835c0e4d44d40ec8d85b0a49aec65941991d48f85077d24f32a665f3014f0bb8af4578e4c565d3eb39b2aa7cd7d824c5cd4b4db1854e7bac7ed2d81336d84cda195e2eb34cb0eaa2aa21c1adc72"], 0x0, 0x1400) 12:46:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306207, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:27 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:27 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='o%erlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:27 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x80013, 0x35) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080)='/dev/audio\x00', 0x101002, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r3, 0x5380) dup3(r2, r1, 0x0) [ 378.261833][T32267] binder: 32265:32267 ioctl c0306201 20000400 returned -14 [ 378.312977][T32274] binder: 32265:32274 ioctl c0306207 20000040 returned -22 12:46:27 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0xf, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 378.369518][T32274] binder_alloc: binder_alloc_mmap_handler: 32265 20001000-20004000 already mapped failed -16 [ 378.415754][T32267] binder: BINDER_SET_CONTEXT_MGR already set [ 378.429787][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 378.435565][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 378.452669][T32267] binder: 32265:32267 ioctl 40046207 0 returned -16 12:46:27 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) socket$inet_dccp(0x2, 0x6, 0x0) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) 12:46:27 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) r2 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_RX_RING(r2, 0x10e, 0x6, &(0x7f0000000100)={0x80000001, 0x80, 0x6}, 0x10) [ 378.465726][T32286] binder_alloc: 32265: binder_alloc_buf, no vma 12:46:27 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='ov\nrlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:27 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000400)=""/19) r5 = socket$inet(0x2, 0x3, 0x2) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r6, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r6, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r7, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r7, 0x28, 0x0, &(0x7f0000000100)=0x4, 0xfffffffffffffdf5) setsockopt$inet_int(r5, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) dup2(r3, r3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000240)) r8 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') openat$vnet(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-net\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f00000004c0)={0xc, 0x8, 0xfa00, {&(0x7f0000000280)}}, 0x1ac) pwritev(r8, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) name_to_handle_at(r3, &(0x7f0000000040)='./file0\x00', &(0x7f0000000980)=ANY=[@ANYBLOB="670000007f000000fc3960ed64350a35f472dda32b5070c45a6b7bdc33ddefe41b202b9cd214bf38ad2ebaf5439debbd5ed7305b882b8e3dd8d5b7c6bdeec403ca74b6562909c6f7ceb71b519de0bd353f94dbc60c2b00f882b993c93f5c0dd26784a3d9568b56018d634ea93a5de68fa2da802097ca11ebcc616ff8d1c0e0d0b3018000000000000089db0761712d1caf9a69816ce4938d4826fc5955d1598b24ee9c15e8ddb2fd13e336720e819d3e1b9c20f5f7357f0ad40d88c0372c1e64edea962afcbb52b7c9e4b82c781fa3d3aabee9f7bbaad8181b797151bc450897dd7bcf8328c069f6393801e0a20645dccbc6b6c96ba1061ea01638ccab599a348e90f7dbfaf9930097462b3902546393bf48a81d57f86932923bf42b6e48a8b421c439237ae612094835af24dfb06a8c5d2846ab3bbff8db1e05b89165713d1626555fb5475a032b75abd56b72897583b14e814307518e670bb4f8e5a7bbaea129234ca6ce59ff2c544fdb5d4defa4d2db65f86ba0de682c7801e4448121669ff1fdf2682ab969ea264cae72ce8b0961a2a03a0d57dd2ddbe686108d3109ee99d4842835c0e4d44d40ec8d85b0a49aec65941991d48f85077d24f32a665f3014f0bb8af4578e4c565d3eb39b2aa7cd7d824c5cd4b4db1854e7bac7ed2d81336d84cda195e2eb34cb0eaa2aa21c1adc72"], 0x0, 0x1400) [ 378.529500][ T3486] binder: release 32265:32267 transaction 188 out, still active [ 378.539882][T32274] binder: 32265:32274 ioctl c0306207 20000040 returned -22 [ 378.556855][ T3486] binder: undelivered TRANSACTION_COMPLETE 12:46:27 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0xc0, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:27 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0xfffffffffffff527, 0x101000) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@reserved}) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000040)={0x1, 0x81, 0x4, 0x0, 0xfffffffffffff001, 0x100000000, 0xffffffffffffffe0, 0x5, 0x0}, &(0x7f0000000080)=0x20) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000100)={r2}, 0x8) setsockopt$inet6_MCAST_LEAVE_GROUP(r1, 0x29, 0x2d, &(0x7f0000000180)={0x3f, {{0xa, 0x4e22, 0xffff, @rand_addr="76261e691b25a23e80023e2b5f25b008", 0x7}}}, 0x88) r3 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r4, r3, 0x0) [ 378.574903][T32286] binder: 32265:32286 transaction failed 29189/-3, size 0-0 line 3147 [ 378.584449][ T3486] binder: send failed reply for transaction 188, target dead [ 378.615620][T32286] binder: 32265:32286 ioctl c0306201 20000400 returned -14 12:46:27 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306225, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 378.655107][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 [ 378.669817][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 378.669843][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 378.675639][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 378.681368][ C0] protocol 88fb is buggy, dev hsr_slave_1 12:46:27 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='ov%rlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:27 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rtc0\x00', 0x80000, 0x0) ioctl$VIDIOC_G_AUDOUT(r3, 0x80345631, &(0x7f0000000040)) shutdown(r1, 0x0) r4 = dup3(r2, r1, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000140)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000100)={0xffffffffffffffff}, 0x2, 0x1}}, 0x20) write$RDMA_USER_CM_CMD_JOIN_IP_MCAST(r4, &(0x7f0000000180)={0x10, 0x30, 0xfa00, {&(0x7f0000000080), 0x2, {0xa, 0x4e23, 0xda91, @ipv4={[], [], @loopback}, 0x4}, r5}}, 0x38) [ 378.766500][T32350] binder: 32322:32350 ioctl c0306201 20000400 returned -14 [ 378.778313][T32350] binder: 32322:32350 ioctl c0306225 20000040 returned -22 [ 378.793754][T32387] binder_alloc: binder_alloc_mmap_handler: 32322 20001000-20004000 already mapped failed -16 12:46:27 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0xec0, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 378.823508][T32350] binder: BINDER_SET_CONTEXT_MGR already set 12:46:27 executing program 2: r0 = userfaultfd(0x0) r1 = syz_open_dev$radio(&(0x7f0000000100)='/dev/radio#\x00', 0x2, 0x2) ioctl$VHOST_VSOCK_SET_GUEST_CID(r1, 0x4008af60, &(0x7f0000000140)={@host}) ioctl$sock_inet6_tcp_SIOCOUTQ(r1, 0x5411, &(0x7f00000000c0)) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000380)={0xaa, 0x4}) ioctl$PPPIOCGIDLE(r1, 0x8010743f, &(0x7f0000000040)) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r2, &(0x7f0000465f8e)=""/114, 0xfffffdeb) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 378.881072][T32422] binder: 32322:32422 ioctl c0306225 20000040 returned -22 [ 378.896868][ T3486] binder: release 32322:32350 transaction 191 out, still active [ 378.907363][T32350] binder: 32322:32350 ioctl 40046207 0 returned -16 [ 378.916439][ T3486] binder: undelivered TRANSACTION_COMPLETE 12:46:27 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000400)=""/19) r5 = socket$inet(0x2, 0x3, 0x2) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r6, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r6, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r7, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r7, 0x28, 0x0, &(0x7f0000000100)=0x4, 0xfffffffffffffdf5) setsockopt$inet_int(r5, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) dup2(r3, r3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000240)) r8 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') openat$vnet(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-net\x00', 0x2, 0x0) write$RDMA_USER_CM_CMD_GET_EVENT(r1, &(0x7f00000004c0)={0xc, 0x8, 0xfa00, {&(0x7f0000000280)}}, 0x1ac) pwritev(r8, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 378.930263][ T3486] binder: send failed reply for transaction 191, target dead 12:46:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc030625c, &(0x7f0000000040)={0x4, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:28 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x33fe0, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:28 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = getpgrp(0x0) r3 = dup2(r0, r1) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r1, 0x84, 0x6d, &(0x7f0000000100)={0x0, 0x79, "4709625a7bcfcd539081e718f598236f00374ac97bc3a4b67a718c3ec857890077980d5bef139d7dc95d5a7d074a6a3011c850ff178665da51cf499fadbc8a7da9a36247b85059034359433e4eab3db1a6fa8a4e3ad9eaf1e231d82f6dca3bba62e2f1938481d4d68fbec2608bbcff3b1e64ba9b4bf1b48a89"}, &(0x7f0000000040)=0x81) getsockopt$inet_sctp_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000080)={r4, 0x34}, &(0x7f00000001c0)=0x8) fcntl$setownex(r0, 0xf, &(0x7f0000000000)={0x0, r2}) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r5, r1, 0x0) 12:46:28 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='ov,rlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:28 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) r2 = syz_open_dev$vcsa(&(0x7f0000000140)='/dev/vcsa#\x00', 0x81, 0x101000) write$P9_RWSTAT(r2, &(0x7f0000000280)={0x7, 0x7f, 0x2}, 0x7) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x2, 0x0) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r2, 0x6612) [ 379.118386][T32444] binder: 32439:32444 ioctl c0306201 20000400 returned -14 12:46:28 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x7ffff, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:28 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r0, 0x0) [ 379.173677][T32450] binder: 32439:32450 ioctl c030625c 20000040 returned -22 [ 379.197409][T32450] binder_alloc: binder_alloc_mmap_handler: 32439 20001000-20004000 already mapped failed -16 12:46:28 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000400)=""/19) r5 = socket$inet(0x2, 0x3, 0x2) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r6, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r6, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r7, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r7, 0x28, 0x0, &(0x7f0000000100)=0x4, 0xfffffffffffffdf5) setsockopt$inet_int(r5, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) dup2(r3, r3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000240)) r8 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') openat$vnet(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-net\x00', 0x2, 0x0) pwritev(r8, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 379.246583][T32444] binder: BINDER_SET_CONTEXT_MGR already set [ 379.259326][T32444] binder: 32439:32444 ioctl 40046207 0 returned -16 [ 379.272464][T32459] binder_alloc: 32439: binder_alloc_buf, no vma [ 379.284815][T32459] binder: 32439:32459 transaction failed 29189/-3, size 0-0 line 3147 12:46:28 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) r2 = syz_open_dev$mice(&(0x7f0000000100)='/dev/input/mice\x00', 0x0, 0x800) ioctl$TUNGETSNDBUF(r2, 0x800454d3, &(0x7f0000000140)) [ 379.320267][T32459] binder: 32439:32459 ioctl c0306201 20000400 returned -14 [ 379.327715][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 379.339872][ T7669] binder: send failed reply for transaction 193 to 32439:32444 12:46:28 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = syz_open_dev$usb(&(0x7f0000000100)='/dev/bus/usb/00#/00#\x00', 0x80000001, 0x202000) ioctl$VIDIOC_G_FBUF(r1, 0x8030560a, &(0x7f00000001c0)={0x44, 0x10, &(0x7f0000000140)="3969dcf7bacf2c7829005f6520bfb548c02fc2a0240e6086681629be077c054bc043791d643369ff29b6798b8c2f7f5eba56bcefdebb20f82145485e44262aae989156cbb292328a", {0x2, 0x80000000, 0x3447504d, 0xf, 0x1, 0x2f, 0x9, 0xffffffff80000000}}) r2 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r3 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vfio/vfio\x00', 0x20000, 0x0) write$P9_RLCREATE(r3, &(0x7f0000000080)={0x18, 0xf, 0x2, {{0x10, 0x3, 0x6}, 0x101}}, 0x18) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) r5 = dup3(r4, r2, 0x0) ioctl$RTC_ALM_SET(r5, 0x40247007, &(0x7f0000000000)={0x33, 0x1e, 0x6, 0x9, 0x1, 0x8628, 0x0, 0xb0, 0xffffffffffffffff}) 12:46:28 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='ov:rlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x2, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 379.388833][ T7669] binder: undelivered TRANSACTION_COMPLETE 12:46:28 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x200002d4, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 379.456448][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 12:46:28 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$sock_inet_SIOCADDRT(r0, 0x890b, &(0x7f0000000400)={0x0, {0x2, 0x4e23, @loopback}, {0x2, 0x4e23, @rand_addr=0x8001}, {0x2, 0x4e21, @broadcast}, 0x28a, 0x0, 0x0, 0x0, 0x400, &(0x7f00000003c0)='bpq0\x00', 0x0, 0x1, 0xfffffffffffffbff}) r3 = dup3(r2, r1, 0x0) bpf$BPF_PROG_GET_NEXT_ID(0xb, &(0x7f0000000280)=0x84, 0x4) write$vnet(r3, &(0x7f0000000200)={0x1, {&(0x7f0000000000)=""/175, 0xaf, &(0x7f0000000100)=""/240, 0x3, 0x2}}, 0x68) [ 379.525561][T32486] binder: 32478:32486 ioctl c0306201 20000400 returned -14 [ 379.539009][T32486] binder: 32478:32486 ERROR: BC_REGISTER_LOOPER called without request [ 379.555025][T32488] binder_alloc: binder_alloc_mmap_handler: 32478 20001000-20004000 already mapped failed -16 12:46:28 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='ov\\rlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 379.585294][T32486] binder: BINDER_SET_CONTEXT_MGR already set [ 379.595346][T32486] binder: 32478:32486 ioctl 40046207 0 returned -16 12:46:28 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x7ffff000, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:28 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000400)=""/19) r5 = socket$inet(0x2, 0x3, 0x2) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r6, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r6, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r7, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r7, 0x28, 0x0, &(0x7f0000000100)=0x4, 0xfffffffffffffdf5) setsockopt$inet_int(r5, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) dup2(r3, r3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000240)) r8 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r8, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 379.631781][ T7669] binder: release 32478:32486 transaction 196 out, still active [ 379.640100][T32488] binder_alloc: 32478: binder_alloc_buf, no vma [ 379.655278][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 379.684887][ T7669] binder: release 32478:32486 transaction 196 in, still active [ 379.692766][T32488] binder: 32478:32488 transaction failed 29189/-3, size 0-0 line 3147 [ 379.712953][ T7669] binder: send failed reply for transaction 196, target dead 12:46:28 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = dup3(0xffffffffffffffff, r1, 0x0) getsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000000), &(0x7f0000000040)=0x8) ioctl$INOTIFY_IOC_SETNEXTWD(r2, 0x40044900, 0x80000001) [ 379.735597][T32488] binder: 32478:32488 ioctl c0306201 20000400 returned -14 [ 379.765661][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 12:46:28 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) r2 = creat(&(0x7f0000000100)='./file0\x00', 0x0) getsockopt$inet_sctp6_SCTP_AUTOCLOSE(r2, 0x84, 0x4, &(0x7f0000000140), &(0x7f0000000280)=0x4) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:28 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0xfffffdef, 0x29, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:28 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='ovjrlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:28 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:28 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000400)=""/19) r5 = socket$inet(0x2, 0x3, 0x2) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r6, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r6, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r7, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r7, 0x28, 0x0, &(0x7f0000000100)=0x4, 0xfffffffffffffdf5) setsockopt$inet_int(r5, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) dup2(r3, r3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000240)) pwritev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 379.965453][T32524] binder: 32520:32524 ioctl c0306201 20000400 returned -14 12:46:29 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = syz_open_dev$sndpcmp(&(0x7f0000000080)='/dev/snd/pcmC#D#p\x00', 0x10000, 0x50180) ioctl$EVIOCGABS2F(r1, 0x8018456f, &(0x7f00000003c0)=""/4096) r2 = socket$inet6(0xa, 0x3, 0x2f) r3 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x7, 0x8000) ioctl$SIOCX25GFACILITIES(r3, 0x89e2, &(0x7f0000000180)) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000040)={0x4}) clock_gettime(0x0, &(0x7f0000000100)={0x0, 0x0}) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS(r3, 0xc0385720, &(0x7f0000000140)={0x0, {r4, r5+30000000}, 0x8, 0x3}) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) socket$nl_xfrm(0x10, 0x3, 0x6) fdatasync(r2) dup2(r3, r0) dup3(r0, r2, 0x0) 12:46:29 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0xf, 0xffffff1f, 0x0, 0x0, {0x8}}, 0x14}}, 0x0) [ 380.015107][T32530] binder: 32520:32530 ERROR: BC_REGISTER_LOOPER called without request 12:46:29 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='ove\nlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 380.091103][T32530] binder_alloc: binder_alloc_mmap_handler: 32520 20001000-20004000 already mapped failed -16 12:46:29 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r1, &(0x7f0000000280)=""/223, 0xfffffefe) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 380.188799][T32524] binder: BINDER_SET_CONTEXT_MGR already set 12:46:29 executing program 3: accept(0xffffffffffffff9c, &(0x7f0000000000)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @ipv4={[], [], @loopback}}}}, &(0x7f0000000080)=0x80) getsockname$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000200)=0x14) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000240)={r1, 0x1, 0x6}, 0x10) r2 = socket$inet_udplite(0x2, 0x2, 0x88) syz_open_dev$sndpcmc(&(0x7f0000000100)='/dev/snd/pcmC#D#c\x00', 0xffffffffffffff01, 0x4000) ioctl(r2, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r3 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r4, r3, 0x0) 12:46:29 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x2, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:29 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000400)=""/19) r5 = socket$inet(0x2, 0x3, 0x2) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r6, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r6, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r7, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r7, 0x28, 0x0, &(0x7f0000000100)=0x4, 0xfffffffffffffdf5) setsockopt$inet_int(r5, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) dup2(r3, r3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000240)) pwritev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 380.248815][T32524] binder: 32520:32524 ioctl 40046207 0 returned -16 [ 380.248835][T32545] binder_alloc: 32520: binder_alloc_buf, no vma [ 380.320066][ T3486] binder: release 32520:32530 transaction 199 in, still active [ 380.368951][ T3486] binder: send failed reply for transaction 199 to 32520:32524 [ 380.381316][T32545] binder: 32520:32545 transaction failed 29189/-3, size 0-0 line 3147 12:46:29 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x4, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:29 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='ove%lay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 380.420002][ T3486] binder: undelivered TRANSACTION_COMPLETE [ 380.425881][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 [ 380.432391][T32545] binder: 32520:32545 ioctl c0306201 20000400 returned -14 12:46:29 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000)='/dev/dlm-control\x00', 0x0, 0x0) getsockopt$TIPC_DEST_DROPPABLE(r1, 0x10f, 0x81, &(0x7f0000000040), &(0x7f0000000080)=0x4) r2 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$int_in(r1, 0x0, &(0x7f0000000100)=0x7) dup3(r3, r2, 0x0) 12:46:29 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x5, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:29 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000400)=""/19) r5 = socket$inet(0x2, 0x3, 0x2) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r6, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r6, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r7, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r7, 0x28, 0x0, &(0x7f0000000100)=0x4, 0xfffffffffffffdf5) setsockopt$inet_int(r5, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) dup2(r3, r3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000240)) pwritev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:29 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x8, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:29 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008913, &(0x7f00000000c0)="000000c21c83eb2ee15fd5") r1 = socket$inet6(0xa, 0x3, 0x2f) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuset.effective_cpus\x00', 0x0, 0x0) ioctl$KDGKBSENT(r2, 0x4b48, &(0x7f0000000040)={0x7fffffff, 0x8, 0x5}) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r3, r1, 0x0) 12:46:29 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='ove,lay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 380.679013][T32576] binder: 32572:32576 ioctl c0306201 20000400 returned -14 [ 380.738135][T32578] binder: 32572:32578 ERROR: BC_REGISTER_LOOPER called without request [ 380.807881][T32578] binder: 32572:32578 unknown command 0 [ 380.838519][T32578] binder: 32572:32578 ioctl c0306201 20000040 returned -22 [ 380.881092][T32576] binder_alloc: binder_alloc_mmap_handler: 32572 20001000-20004000 already mapped failed -16 [ 380.938243][T32578] binder_alloc: 32572: binder_alloc_buf, no vma [ 380.959630][T32576] binder: BINDER_SET_CONTEXT_MGR already set [ 380.998466][T32578] binder: 32572:32578 transaction failed 29189/-3, size 0-0 line 3147 [ 381.031036][T32576] binder: 32572:32576 ioctl 40046207 0 returned -16 [ 381.031463][ T7669] binder: send failed reply for transaction 202 to 32572:32576 [ 381.041384][T32578] binder: 32572:32578 ioctl c0306201 20000400 returned -14 12:46:30 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000400)=""/19) r5 = socket$inet(0x2, 0x3, 0x2) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r6, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r6, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r7, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r7, 0x28, 0x0, &(0x7f0000000100)=0x4, 0xfffffffffffffdf5) setsockopt$inet_int(r5, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) dup2(r3, r3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r8 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r8, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:30 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xa, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:30 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = socket$inet6(0xa, 0x1, 0x521a4c53) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r1, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x1}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f0000000080)={r4, 0x10001}, &(0x7f0000000100)=0x8) r5 = dup3(r2, r1, 0x0) accept4$tipc(r5, &(0x7f0000000140), &(0x7f0000000180)=0x10, 0x80000) ioctl$FIDEDUPERANGE(r5, 0xc0189436, &(0x7f00000004c0)=ANY=[@ANYBLOB="350000002000000008000000000000000600000000000000", @ANYRES32=r0, @ANYBLOB="00000000040900000000000000000000000000000000000000000000", @ANYRES32=r0, @ANYBLOB="00000000030000000000000000000000000000000000000000000000", @ANYRES32=r1, @ANYBLOB="00000000bc0000000000000000000000000000000000000000000000", @ANYRES32=r5, @ANYBLOB='\x00\x00\x00\x00\t\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r5, @ANYBLOB='\x00\x00\x00\x00$\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r2, @ANYBLOB="00000000ff0000000000000000000000000000000000000000000000"]) 12:46:30 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x26045e6ef40d1bc7, 0x0) r3 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000140)='/dev/cachefiles\x00', 0x1, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f00004f5000/0x18000)=nil, &(0x7f0000000300)=[@text64={0x40, &(0x7f0000000280)="c4414812ce66b89a008ed866ba4100b800880000ef470f32460fc7f1c462edb8f3f4c7442400bd000000c7442402aa00c0feff1c24c744240002000000c744240201000000c7442406000000000f01142466b8b2000f00d8", 0x58}], 0x1, 0xc, &(0x7f0000000340)=[@dstype0={0x6, 0x9}], 0x1) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:30 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='ove/lay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 381.078804][ T7669] binder_release_work: 1 callbacks suppressed [ 381.078811][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 12:46:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x6, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 381.158216][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 381.195678][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 12:46:30 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xe, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:30 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = syz_open_dev$audion(&(0x7f0000000000)='/dev/audio#\x00', 0x8, 0x40) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040)='/dev/vsock\x00', 0x10000, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, &(0x7f0000000100)="39610066b8000000000f23d80f21f86635c00000f00f23f8656536260f01bbabf3ea04000b0066b92203000066b80100000066ba000000000f3036660f157ddf0f01df0f01cf0f22d966b9530a00000f32", 0x51}], 0x1, 0x40, &(0x7f0000000180), 0x0) r3 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000280)={r2, &(0x7f0000000180)="acb0f0016d185ce51bcb7541fdf197e45b6900150059417e7f79f36b42372eab127513f4bfa016ff7de3df372158981a72fd22a087444df1a8ab5ac8850bdb1fe67bf21419199e834bc1a7dea69bce38d8d33b1d707d065b6af2653672b5334ecc0692071728df6604acf57cb59432711ea7248889638425d47cf85ad1670e4df0eb7c7e14137345554e732765cac7e52544d996de1961c96cc836f53fc6bf3330db40785987aa0fae5a3e4ea62557b655641e873571dd9a662e136862cb16a1cea745dcacfeca45c16f8de17b", &(0x7f00000003c0)=""/225}, 0x18) dup3(r4, r3, 0x0) 12:46:30 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='ove\\lay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:30 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000400)=""/19) r5 = socket$inet(0x2, 0x3, 0x2) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r6, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r6, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r7, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r7, 0x28, 0x0, &(0x7f0000000100)=0x4, 0xfffffffffffffdf5) setsockopt$inet_int(r5, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) dup2(r3, r3) r8 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r8, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 381.365158][T32625] binder: 32617:32625 ioctl c0306201 20000400 returned -14 12:46:30 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000836000/0x3000)=nil, 0x3000}, 0x1}) [ 381.409898][T32625] binder: 32617:32625 ERROR: BC_REGISTER_LOOPER called without request 12:46:30 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xf, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:30 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) [ 381.465998][T32625] binder: 32617:32625 unknown command 0 12:46:30 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='over\nay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 381.525793][T32625] binder: 32617:32625 ioctl c0306201 20000040 returned -22 [ 381.571517][T32644] binder_alloc: binder_alloc_mmap_handler: 32617 20001000-20004000 already mapped failed -16 12:46:30 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000140)='/dev/sequencer\x00', 0x0, 0x0) ioctl$LOOP_CLR_FD(r2, 0x4c01) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) r3 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rfkill\x00', 0x80081, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r3, 0x84, 0x6b, &(0x7f0000000280)=[@in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}, @in6={0xa, 0x4e24, 0x1214, @empty, 0x1000}, @in6={0xa, 0x4e23, 0x3610, @empty, 0x1}, @in={0x2, 0x4e20, @empty}, @in={0x2, 0x4e21, @multicast2}], 0x68) 12:46:30 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000400)=""/19) r5 = socket$inet(0x2, 0x3, 0x2) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r6, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r6, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r7, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r7, 0x28, 0x0, &(0x7f0000000100)=0x4, 0xfffffffffffffdf5) setsockopt$inet_int(r5, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) dup2(r3, r3) r8 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r8, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 381.654618][T32625] binder: BINDER_SET_CONTEXT_MGR already set [ 381.680653][T32625] binder: 32617:32625 ioctl 40046207 0 returned -16 [ 381.681652][T32651] binder_alloc: 32617: binder_alloc_buf, no vma 12:46:30 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x10, 0x0, {0x8}}, 0x14}}, 0x0) [ 381.730000][ T7669] binder: release 32617:32625 transaction 205 out, still active [ 381.737742][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 381.764088][T32651] binder: 32617:32651 transaction failed 29189/-3, size 0-0 line 3147 [ 381.786409][ T7669] binder: send failed reply for transaction 205, target dead [ 381.794061][T32651] binder: 32617:32651 ioctl c0306201 20000400 returned -14 [ 381.810048][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 12:46:30 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x7, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:30 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) pipe2(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) fcntl$getown(r0, 0x9) ioctl$TCSETAF(r1, 0x5408, &(0x7f0000000000)={0x8, 0x5, 0x7, 0x80b, 0xe, 0xffff, 0x33b3, 0xfc, 0x7, 0x2446c94d}) ioctl(r0, 0x1000008910, &(0x7f00000000c0)="0adc1f123c123f3188b070") r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='memory.events\x00', 0x0, 0x0) ioctl$BLKBSZGET(r3, 0x80081270, &(0x7f0000000040)) r4 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$bt_BT_FLUSHABLE(r2, 0x112, 0x8, &(0x7f00000003c0)=0x400, 0x4) syz_open_dev$sndpcmc(&(0x7f0000000100)='/dev/snd/pcmC#D#c\x00', 0x7fff, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) socket$nl_xfrm(0x10, 0x3, 0x6) r5 = syz_genetlink_get_family_id$net_dm(&(0x7f00000001c0)='NET_DM\x00') sendmsg$NET_DM_CMD_START(r1, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x14, r5, 0x1, 0x70bd28, 0x25dfdbfc, {}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x20000000}, 0x24040000) dup3(r4, r4, 0x40000000000) 12:46:30 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='over%ay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:30 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x60, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:31 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r1, &(0x7f0000000180)=""/223, 0x18616f72) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) r2 = syz_open_dev$midi(&(0x7f0000000140)='/dev/midi#\x00', 0x3ff, 0x40000) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffff9c, 0x84, 0x18, &(0x7f0000000280)={0x0, 0x10000}, &(0x7f00000002c0)=0x8) setsockopt$inet_sctp_SCTP_AUTH_KEY(r2, 0x84, 0x17, &(0x7f0000000300)={r3, 0x4, 0xcc, "fe9281b1fc48d2dead133c53c2ff1de336e3d1a2da264974336939e15b11fcbff5c6d04e4ce15a58e264b7aa2fced85850c6ace638056683396f4289d326d6237f31dc96247ce26a1fa110880dc4d08ee3a6598c94b1740f1a87cd7f0c3bb36396ee48fe1c991e2ddb32d22b9c90e604da06eacf98f58a544c530b962c1ba351130fe79129908f0cac1998e014745605266694a6bacbce48460584f4c31fe8a75b301874586c430a5f0314fa7d5617fdb943fdaf7a3fa553a86df05b1da3a74f363e507b4ad07d0ffaa97f24"}, 0xd4) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100)='/dev/snapshot\x00', 0x0, 0x0) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 382.049401][T32678] binder: 32671:32678 ioctl c0306201 20000400 returned -14 12:46:31 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) r4 = socket$inet(0x2, 0x3, 0x2) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r5, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r5, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r6 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r5, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r6, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r6, 0x28, 0x0, &(0x7f0000000100)=0x4, 0xfffffffffffffdf5) setsockopt$inet_int(r4, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) r7 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r7, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:31 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x400, 0xffff}, {0x0, 0x8000000000}, 0x5, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) 12:46:31 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='over,ay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:31 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xf0, 0x0, {0x8}}, 0x14}}, 0x0) [ 382.129511][T32683] binder: 32671:32683 ERROR: BC_REGISTER_LOOPER called without request [ 382.194524][T32683] binder: 32671:32683 unknown command 0 12:46:31 executing program 3: r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='/dev/ubi_ctrl\x00', 0x8000, 0x0) ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000000080)={0x0, 0x8, &(0x7f0000000040)="e0aba556d2d71381"}) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f00000000c0)="160db823226a2ace88b070") r2 = socket$inet6(0xa, 0xffffffffffffffff, 0x32) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r3, r2, 0x0) [ 382.235101][T32683] binder: 32671:32683 ioctl c0306201 20000040 returned -22 [ 382.299011][T32678] binder_alloc: binder_alloc_mmap_handler: 32671 20001000-20004000 already mapped failed -16 12:46:31 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) r4 = socket$inet(0x2, 0x3, 0x2) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r5, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r5, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r6 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r5, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r6, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r6, 0x28, 0x0, &(0x7f0000000100)=0x4, 0xfffffffffffffdf5) setsockopt$inet_int(r4, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) r7 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r7, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:31 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x2ef, 0x0, {0x8}}, 0x14}}, 0x0) [ 382.344952][T32683] binder_alloc: 32671: binder_alloc_buf, no vma [ 382.360172][T32683] binder: 32671:32683 transaction failed 29189/-3, size 0-0 line 3147 [ 382.368392][T32683] binder: 32671:32683 ioctl c0306201 20000400 returned -14 [ 382.391020][ T3486] binder: send failed reply for transaction 208 to 32671:32678 [ 382.398687][ T3486] binder: undelivered TRANSACTION_COMPLETE 12:46:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x12, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:31 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='over.ay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:31 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) ioctl$KVM_GET_MSRS(r2, 0xc008ae88, &(0x7f0000000000)={0x5, 0x0, [{}, {}, {}, {}, {}]}) [ 382.447545][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 [ 382.477729][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 12:46:31 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xa00, 0x0, {0x8}}, 0x14}}, 0x0) [ 382.585440][T32722] binder: 32720:32722 ioctl c0306201 20000400 returned -14 [ 382.599822][ C1] net_ratelimit: 18 callbacks suppressed [ 382.599830][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 382.609542][T32722] binder: 32720:32722 ERROR: BC_REGISTER_LOOPER called without request [ 382.611296][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 382.620394][T32722] binder: 32720:32722 unknown command 0 [ 382.651155][T32722] binder: 32720:32722 ioctl c0306201 20000040 returned -22 [ 382.686259][T32729] binder_alloc: binder_alloc_mmap_handler: 32720 20001000-20004000 already mapped failed -16 [ 382.710619][T32722] binder: BINDER_SET_CONTEXT_MGR already set [ 382.727289][T32722] binder: 32720:32722 ioctl 40046207 0 returned -16 [ 382.727333][T32729] binder_alloc: 32720: binder_alloc_buf, no vma [ 382.746325][T32729] binder: 32720:32729 transaction failed 29189/-3, size 0-0 line 3147 [ 382.756451][T32722] binder: 32720:32722 ERROR: BC_REGISTER_LOOPER called without request [ 382.756557][ T7669] binder: release 32720:32722 transaction 211 out, still active [ 382.771517][T32722] binder: 32720:32722 unknown command 0 [ 382.773386][T32729] binder: 32720:32729 ioctl c0306201 20000400 returned -14 [ 382.778177][T32722] binder: 32720:32722 ioctl c0306201 20000040 returned -22 [ 382.785587][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 382.798603][ T7669] binder: send failed reply for transaction 211, target dead [ 382.818035][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 382.829801][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 382.829828][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 382.835563][ C0] protocol 88fb is buggy, dev hsr_slave_1 12:46:31 executing program 2: r0 = userfaultfd(0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(0xffffffffffffff9c, 0x84, 0x70, &(0x7f0000000280)={0x0, @in={{0x2, 0x4e22, @multicast2}}, [0x2, 0x2, 0x6, 0xffff, 0x1000, 0x401, 0x6, 0x1, 0x6, 0x2, 0xfb61, 0x3, 0x9d0, 0x5, 0x3]}, &(0x7f0000000040)=0x100) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000140)={r1}, &(0x7f0000000380)=0x8) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r2, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:31 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r4, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r5, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r5, 0x28, 0x0, &(0x7f0000000100)=0x4, 0xfffffffffffffdf5) r6 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r6, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:31 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = dup3(r2, r1, 0x0) setsockopt$inet_dccp_int(r3, 0x21, 0x5, &(0x7f0000000000)=0x7f, 0x4) prctl$PR_SET_SECUREBITS(0x1c, 0x24) 12:46:31 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xe00, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:31 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='over:ay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:31 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x5c, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 383.004095][T32744] binder: 32739:32744 ioctl c0306201 20000400 returned -14 [ 383.019307][T32744] binder: 32739:32744 ERROR: BC_REGISTER_LOOPER called without request [ 383.039515][T32744] binder: 32739:32744 unknown command 0 12:46:32 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xec0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:32 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) setsockopt$inet_sctp6_SCTP_DISABLE_FRAGMENTS(r1, 0x84, 0x8, &(0x7f0000000040)=0x734, 0x4) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) [ 383.058228][T32744] binder: 32739:32744 ioctl c0306201 20000040 returned -22 12:46:32 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overLay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 383.114995][T32751] binder_alloc: binder_alloc_mmap_handler: 32739 20001000-20004000 already mapped failed -16 [ 383.136079][T32744] binder: BINDER_SET_CONTEXT_MGR already set 12:46:32 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r4, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r5, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) r6 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r6, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:32 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) r2 = syz_open_dev$mouse(&(0x7f0000000100)='/dev/input/mouse#\x00', 0x4, 0x80000) connect$bt_rfcomm(r2, &(0x7f0000000140)={0x1f, {0xe7, 0x1f, 0x400, 0xffffffffffffffff, 0xabe, 0x7}, 0x3}, 0xa) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 383.179479][T32744] binder: 32739:32744 ioctl 40046207 0 returned -16 12:46:32 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xf00, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:32 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) r2 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-control\x00', 0x20000, 0x0) openat$cgroup_procs(r2, &(0x7f0000000140)='cgroup.threads\x00', 0x2, 0x0) r3 = openat$full(0xffffffffffffff9c, &(0x7f0000000000)='/dev/full\x00', 0x44100, 0x0) sendmmsg$nfc_llcp(r2, &(0x7f0000000840)=[{&(0x7f0000000180)={0x27, 0x0, 0x2, 0x7, 0xffffffffffff0126, 0x8, "5af1ae9fa88d5f46778ee52c218683cf781362f72d1ca0db53ac664e5da8078e0c23f37e7274a3ff579dad8e4ff9d1811698e6253bbdb75a1cff0e0cb6349a", 0x2f}, 0x60, &(0x7f00000006c0)=[{&(0x7f0000000200)="e2787ee24ab80c65014025443d5e656cb5041c3f3b14ac7f2b841e726cbf2b87445df7a03de452a89765e66a7d5a0da6bf3900ddde9bd090e42f7f87a3ea13cf954bd168feee222756994e93411f04e6a182887427c3ff5891f2e1647f5c9c618d3eacb55e6e27517670398af2612a12ac39babdab220e3e33e70dd5033e7e06b2b48af82612c172f45a518933d01ea5316d", 0x92}, {&(0x7f00000003c0)="23050f8950700d077ecf461a60fbdc87f83374a328fae8d119e940dc87c5239f0290ca5733dc82e2cd", 0x29}, {&(0x7f0000000400)="7d1b5b243b133a1fb2c6da3fe627d320e2e01d9f167e4070c152150c353a6e2e084e5e60e4377475dd962416efa5e30c6b0499b95f19f3e4742fa64c136deef514efe8ebb6245a0a83ebd7579bd2513a816927e3ac3029b1054b5d14a83209a4b5881e5a6d75c6271e20d2cff7e42ea9a6ca91c5658e7b179a59b07274eea364e5c55c228b78839adfa1b76494c0a3bd9d13795dc4e0d5cb5e9e4a731df80e8b2a1060db7cf542940ee2c97dceba0ad31dc82d33e676c1d3a3bee42720d36e945dcc4246fa42c1c3", 0xc8}, {&(0x7f0000000500)="8ac00b7a89ad969717059ea46acd184ed9d8069b8bb11d53f5734c716ba095100b9cc2601f4f00a82cc7d0367e7a3ccb1473c48eca5306e06538e8b0f049f6a85d5693735f32fc59591ab5908c5c9c04c8d76505f9", 0x55}, {&(0x7f0000000580)="d80f19ab3994b291fe63b8722600d4deeea2ba0a5eb61a95726c5075e1263d5c52adc9b94786898499cbbee3e197294ad99956cce86aca62653cc8f4d7bd50e13a45a45d4552e19f097af78fb2ac4395414debe83aca1d776f7c8533277b28e12aab8ac938cef575af8180a5d7fe2fe3efbd6d7537d22d8e169527a21c3b7f5d326a2ae115f1a2dca8d989ad", 0x8c}, {&(0x7f0000000640)="4b7487fc20c6b3804e88a956ff67cbbd0611868f0e27b90e3c3e35c792a7953aaadd168b27f1422bfb409e90a0c65b169585392df43db8605a6eddbfa71e13254517f4ccde644c05146ca8fe4f9fcb045e17541847a6b8052e2d3e8670c88511b20273761c97fe1ef9", 0x69}], 0x6, &(0x7f0000000740)={0xe8, 0x10f, 0x8, "e77c97731fd657b0de1fa2fbaaa1b910cda9d3d222dd5cd721175e32589fecae5cac2cfca64add5fe37720ed23096c5274338661fcf34d85edd4757eae450a498d10e8d6b7dbeff7b986141f9868edd444e82598000aa47978c161c6d1ef34661560929f2c15e240439f6f3e687541881d7076b9c7e61a9a141877f923a98529e9e661248562630a6293dce6614fb785dbe32d639bc6c3b9ea4e243fe6854f456cd700a6325d836b9f01a6a9806980b02dd82b786df15d35569a260692fa8f9001414d3edad5735a650ff953dc03d37767ec4bd12e"}, 0xe8, 0x4008004}], 0x1, 0x4010) ioctl$DRM_IOCTL_AGP_ENABLE(r3, 0x40086432, &(0x7f0000000040)=0x10000) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$PPPIOCATTCHAN(r3, 0x40047438, &(0x7f0000000080)=0x2) dup3(r0, r1, 0x80000) [ 383.264096][ T7669] binder: send failed reply for transaction 214 to 32739:32744 [ 383.278466][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 383.300269][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 12:46:32 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='over\\ay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:32 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x5c00, 0x0, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:32 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x6000, 0x0, {0x8}}, 0x14}}, 0x0) [ 383.389893][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 383.395878][ C0] protocol 88fb is buggy, dev hsr_slave_1 12:46:32 executing program 3: r0 = syz_open_dev$mouse(&(0x7f0000000000)='/dev/input/mouse#\x00', 0x5, 0x202000) ioctl$EVIOCGBITKEY(r0, 0x80404521, &(0x7f00000003c0)=""/186) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r1, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r2 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r3, r2, 0x0) 12:46:32 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xfffffffffffffeeb) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00008ff000/0x2000)=nil, 0x2000}, 0x2}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) r2 = dup2(r1, r1) setsockopt$netlink_NETLINK_CAP_ACK(r2, 0x10e, 0xa, &(0x7f0000000000)=0x7fff, 0x4) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vcs\x00', 0x101000, 0x0) ioctl$BLKRRPART(r3, 0x125f, 0x0) 12:46:32 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r4, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r5, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) r6 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r6, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 383.526322][ T320] binder: 317:320 ioctl c0306201 20000400 returned -14 [ 383.590817][ T331] binder: 317:331 ERROR: BC_REGISTER_LOOPER called without request [ 383.629787][ C0] protocol 88fb is buggy, dev hsr_slave_0 12:46:32 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xc00e, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:32 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overmay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 383.635631][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 383.644880][ T331] binder: 317:331 unknown command 0 [ 383.664606][ T331] binder: 317:331 ioctl c0306201 20000040 returned -22 12:46:32 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) recvfrom$inet6(r1, &(0x7f0000000000)=""/88, 0x58, 0x40010041, &(0x7f0000000080)={0xa, 0x4e23, 0x7fff, @remote, 0x4}, 0x1c) dup3(r2, r1, 0x0) 12:46:32 executing program 2: r0 = userfaultfd(0x800) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) [ 383.692391][ T331] binder_alloc: binder_alloc_mmap_handler: 317 20001000-20004000 already mapped failed -16 12:46:32 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overuay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 383.801067][ T320] binder: BINDER_SET_CONTEXT_MGR already set 12:46:32 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xef02, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:32 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = dup3(r2, r1, 0x0) msgget(0x2, 0x200) ioctl$SIOCGSTAMP(r3, 0x8906, &(0x7f0000000000)) [ 383.863303][ T320] binder: 317:320 ioctl 40046207 0 returned -16 [ 383.863346][ T331] binder_alloc: 317: binder_alloc_buf, no vma [ 383.898527][ T331] binder: 317:331 transaction failed 29189/-3, size 0-0 line 3147 [ 383.906640][ T331] binder: 317:331 ioctl c0306201 20000400 returned -14 [ 383.926997][ T3486] binder: release 317:320 transaction 216 out, still active [ 383.930736][ T320] binder: 317:320 ERROR: BC_REGISTER_LOOPER called without request [ 383.942414][ T3486] binder: undelivered TRANSACTION_COMPLETE [ 383.948281][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 [ 383.984398][ T3486] binder: send failed reply for transaction 216, target dead [ 383.990936][ T320] binder: 317:320 unknown command 0 [ 384.009278][ T320] binder: 317:320 ioctl c0306201 20000040 returned -22 12:46:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x2, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:33 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r4, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) r5 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r5, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:33 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = socket$inet6(0xa, 0x3, 0x2f) ioctl$int_in(r1, 0x5452, &(0x7f0000000000)=0x80) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x0, 0x0, 0x0, 0x0, 0xa}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@loopback}}, 0xe8) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r2, r1, 0x0) 12:46:33 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xf000, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:33 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overl\ny\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 384.109782][ C1] protocol 88fb is buggy, dev hsr_slave_0 12:46:33 executing program 3: r0 = socket$inet_udplite(0x2, 0x2, 0x88) clock_settime(0x3, &(0x7f0000000080)) ioctl(r0, 0x1000008912, &(0x7f00000000c0)="0adc1f123c123f3188b070") r1 = syz_open_dev$media(&(0x7f0000000000)='/dev/media#\x00', 0x0, 0x2) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r1, 0xc0145401, &(0x7f0000000040)={0x2, 0x1, 0x400, 0x3, 0x800}) r2 = socket$inet6(0xa, 0x3, 0x2f) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f00000002c0)={{{@in6=@remote, @in, 0x4e21, 0x0, 0x0, 0x0, 0xa}, {0x635b6411, 0x1}, {0x0, 0xfffffffffffffffe, 0x1000000000}, 0xfffffffffffffffd, 0x400000000000000, 0x1}, {{@in=@multicast2, 0x0, 0xff}, 0x0, @in6=@mcast2}}, 0xe8) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) dup3(r3, r2, 0x0) fchmod(r3, 0x40000040) 12:46:33 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x34000, 0x0, {0x8}}, 0x14}}, 0x0) [ 384.152626][ T379] binder: 377:379 ioctl c0306201 20000400 returned -14 [ 384.189431][ T379] binder: 377:379 unknown command 0 12:46:33 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r4, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r5, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) r6 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r6, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 384.211962][ T379] binder: 377:379 ioctl c0306201 20000040 returned -22 [ 384.234206][ T386] binder_alloc: binder_alloc_mmap_handler: 377 20001000-20004000 already mapped failed -16 [ 384.279289][ T379] binder: BINDER_SET_CONTEXT_MGR already set [ 384.299010][ T379] binder: 377:379 ioctl 40046207 0 returned -16 [ 384.314712][ T392] binder_alloc: 377: binder_alloc_buf, no vma [ 384.335827][ T392] binder: 377:392 transaction failed 29189/-3, size 0-0 line 3147 [ 384.386078][ T379] binder: 377:379 unknown command 0 [ 384.400197][ T3486] binder: release 377:379 transaction 219 out, still active [ 384.407989][ T379] binder: 377:379 ioctl c0306201 20000040 returned -22 [ 384.418155][ T3486] binder: undelivered TRANSACTION_COMPLETE [ 384.444393][ T3486] binder: send failed reply for transaction 219, target dead [ 384.453280][ T392] binder: 377:392 ioctl c0306201 20000400 returned -14 [ 384.472071][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 12:46:33 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000140)='/dev/rtc0\x00', 0x20081, 0x0) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(0xffffffffffffff9c, 0x84, 0x76, &(0x7f0000000300)={0x0, 0xffffffff}, &(0x7f0000000340)=0x8) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000380)={r2, 0x10000}, &(0x7f00000003c0)=0x8) r3 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r3, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) r4 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vsock\x00', 0xc000, 0x0) bind$netrom(r4, &(0x7f0000000280)={{0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x7}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @null]}, 0x48) 12:46:33 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overl%y\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:33 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r5, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:33 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r4, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r5, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) r6 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r6, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:33 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x400300, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:33 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x3, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 384.655561][ T412] binder: 405:412 ioctl c0306201 20000400 returned -14 12:46:33 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xf0ffff, 0x0, {0x8}}, 0x14}}, 0x0) [ 384.701586][ T417] binder: 405:417 unknown command 0 [ 384.718812][ T417] binder: 405:417 ioctl c0306201 20000040 returned -22 12:46:33 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overljy\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:33 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r5 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r5, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 384.777012][ T417] binder_alloc: binder_alloc_mmap_handler: 405 20001000-20004000 already mapped failed -16 12:46:33 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r4, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r5, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) r6 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r6, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:33 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x1000000, 0x0, {0x8}}, 0x14}}, 0x0) [ 384.851473][ T417] binder_alloc: 405: binder_alloc_buf, no vma [ 384.875154][ T427] binder: BINDER_SET_CONTEXT_MGR already set 12:46:33 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x80000000000}) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/ubi_ctrl\x00', 0x20000, 0x0) ioctl$VIDIOC_TRY_ENCODER_CMD(r2, 0xc028564e, &(0x7f0000000140)={0x1, 0x1, [0x0, 0x0, 0x1, 0x0, 0x5, 0x5, 0x8, 0x1]}) lsetxattr$security_selinux(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)='security.selinux\x00', &(0x7f0000000300)='system_u:object_r:ssh_exec_t:s0\x00', 0x20, 0x1) close(r1) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 384.930411][ T412] binder: 405:412 unknown command 0 [ 384.945295][ T412] binder: 405:412 ioctl c0306201 20000040 returned -22 [ 384.957394][ T417] binder: 405:417 transaction failed 29189/-3, size 0-0 line 3147 [ 384.975418][ T3486] binder: release 405:412 transaction 222 out, still active [ 384.983302][ T427] binder: 405:427 ioctl 40046207 0 returned -16 [ 384.999438][ T3486] binder: undelivered TRANSACTION_COMPLETE [ 385.014146][ T417] binder: 405:417 ioctl c0306201 20000400 returned -14 12:46:34 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overla\n\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 385.028217][ T3486] binder: send failed reply for transaction 222, target dead 12:46:34 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x2000000, 0x0, {0x8}}, 0x14}}, 0x0) [ 385.060727][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 12:46:34 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x4, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:34 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000000100)=""/114, 0x4b) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:34 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x4000000, 0x0, {0x8}}, 0x14}}, 0x0) [ 385.216583][ T552] binder: 549:552 ioctl c0306201 20000400 returned -14 12:46:34 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r5 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r5, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:34 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r4, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r5, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) pwritev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:34 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overla%\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:34 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x8000000, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:34 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x02', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:34 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xa000000, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:34 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r4, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r5, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) pwritev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:34 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r5, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:34 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xe000000, 0x0, {0x8}}, 0x14}}, 0x0) [ 386.004365][ T597] binder_alloc: binder_alloc_mmap_handler: 549 20001000-20004000 already mapped failed -16 [ 386.015005][ T597] binder: BINDER_SET_CONTEXT_MGR already set [ 386.022261][ T597] binder: 549:597 ioctl 40046207 0 returned -16 [ 386.027145][ T598] binder_alloc: 549: binder_alloc_buf, no vma [ 386.034750][ T598] binder: 549:598 transaction failed 29189/-3, size 0-0 line 3147 [ 386.042737][ T598] binder: 549:598 ioctl c0306201 20000400 returned -14 12:46:35 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x5, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 386.049988][ T3486] binder: release 549:552 transaction 225 out, still active [ 386.057464][ T3486] binder: undelivered TRANSACTION_COMPLETE [ 386.070569][ T3486] binder: send failed reply for transaction 225, target dead 12:46:35 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000280)={0xaa, 0x1}) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100)='/dev/zero\x00', 0x302, 0x0) ioctl$SIOCSIFMTU(r2, 0x8922, &(0x7f0000000140)={'bcsf0\x00', 0x2c}) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:35 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xf000000, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:35 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x03', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:35 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) r5 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r5, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:35 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r4, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r5, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) pwritev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 386.108085][ T601] binder: 600:601 ioctl c0306201 20000400 returned -14 12:46:35 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x10000000, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:35 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x04', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:35 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r4, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) r5 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r5, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:35 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r4, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:35 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x60000000, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:35 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x73}) read(0xffffffffffffffff, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 386.907867][ T646] binder_alloc: binder_alloc_mmap_handler: 600 20001000-20004000 already mapped failed -16 [ 386.918244][ T645] binder: BINDER_SET_CONTEXT_MGR already set [ 386.924340][ T645] binder: 600:645 ioctl 40046207 0 returned -16 [ 386.924619][ T646] binder_alloc: 600: binder_alloc_buf, no vma [ 386.936874][ T646] binder: 600:646 transaction failed 29189/-3, size 0-0 line 3147 [ 386.944762][ T646] binder: 600:646 ioctl c0306201 20000400 returned -14 12:46:36 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x9effffff, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:36 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x05', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x6, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:36 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r4, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) r5 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r5, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:36 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r4, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 386.952876][ T3486] binder: release 600:601 transaction 228 out, still active [ 386.960677][ T3486] binder: undelivered TRANSACTION_COMPLETE [ 386.966571][ T3486] binder_release_work: 1 callbacks suppressed [ 386.966577][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 [ 386.978981][ T3486] binder: send failed reply for transaction 228, target dead 12:46:36 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xc00e0000, 0x0, {0x8}}, 0x14}}, 0x0) [ 387.065155][ T658] binder: 656:658 ioctl c0306201 20000400 returned -14 12:46:36 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r5, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:36 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r4, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:36 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x06', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:36 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xef020000, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:36 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) r4 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r4, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:36 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r1, &(0x7f0000000480)=""/223, 0xfffffffffffffe0a) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:36 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\a', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:36 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r5, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:36 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xf0ffffff, 0x0, {0x8}}, 0x14}}, 0x0) [ 387.789817][ C0] net_ratelimit: 21 callbacks suppressed [ 387.789841][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 387.801356][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 387.862444][ T703] binder_alloc: binder_alloc_mmap_handler: 656 20001000-20004000 already mapped failed -16 [ 387.872792][ T702] binder: BINDER_SET_CONTEXT_MGR already set [ 387.878830][ T702] binder: 656:702 ioctl 40046207 0 returned -16 [ 387.879187][ T703] binder_alloc: 656: binder_alloc_buf, no vma [ 387.892484][ T703] binder: 656:703 transaction failed 29189/-3, size 0-0 line 3147 [ 387.900375][ T703] binder: 656:703 ioctl c0306201 20000400 returned -14 12:46:36 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x7, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:36 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r5 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r5, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:36 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) r3 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r3, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:36 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\b', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:36 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xfffff000, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:36 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = dup(r0) ioctl$SNDRV_CTL_IOCTL_PCM_INFO(r1, 0xc1205531, &(0x7f0000000300)={0x4, 0x7fffffff, 0x6, 0x6, [], [], [], 0x112, 0x7, 0x800, 0x8001, "d5885e2f9135966dcd608d5f22bd29b1"}) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) r3 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100)='/dev/autofs\x00', 0x2000, 0x0) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r3, 0x84, 0x21, &(0x7f0000000140)=0x4, 0x4) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r2, &(0x7f0000465f8e)=""/114, 0x72) recvmsg(r3, &(0x7f0000000600)={&(0x7f0000000440)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @multicast1}}}, 0x80, &(0x7f0000000580)=[{&(0x7f00000004c0)=""/130, 0x82}], 0x1, &(0x7f00000005c0)=""/32, 0x20}, 0x10021) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r4, 0x10f, 0x84, &(0x7f0000000640), &(0x7f0000000680)=0x4) ioctl$KDSKBSENT(r3, 0x4b49, &(0x7f0000000280)="b8b8a0c6f7471737f250a189889ee24ee615cdafff3a40fc9d3698f2b996d7eae2438633bf2b718841bb65811f91cd145e27aa1c1ce2a8efe35334e37f9d7eb36866bdbc33db715589f3fee5cdfb15cf24e0f33ffac6923b0e2e2f397166e119f9a15433a65049d67487e6523915b41873662a3e87") ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 387.907508][ T7669] binder: release 656:658 transaction 231 out, still active [ 387.921413][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 387.927322][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 387.977219][ T7669] binder: send failed reply for transaction 231, target dead 12:46:37 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xffffff7f, 0x0, {0x8}}, 0x14}}, 0x0) [ 388.041410][ T719] binder: 716:719 ioctl c0306201 20000400 returned -14 12:46:37 executing program 2: r0 = userfaultfd(0x0) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/ubi_ctrl\x00', 0x2, 0x0) ioctl$TIOCNOTTY(r1, 0x5422) fsetxattr$trusted_overlay_upper(r1, &(0x7f0000000280)='trusted.overlay.upper\x00', &(0x7f0000000380)={0x0, 0xfb, 0x9c, 0x6, 0x966, "6e412038c950a5d34a9e23a8dfdc968a", "0320fd1c3075c282eb3b5ee3f969ad7a08253386e514ea4136123636541ab3975b3b0616a533a2abce46366308807dd0eb62573b6a745c9ddbfb6f428fa80e45b18e6e3dabb62962f9ba630abab52d65b3ce66e94bd2f7fdecf1fa5a02b16c8913c552dde15a90fa1512e4a399c7ac7ddd1ab7195e1af81ef6a0c571f383b2988b1e13da245a54"}, 0x9c, 0x2) fcntl$F_GET_FILE_RW_HINT(r1, 0x40d, &(0x7f0000000340)) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000000)={0xffffffffffffffff}, 0x111, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r2, &(0x7f0000000300)={0x7, 0x8, 0xfa00, {r3, 0x5}}, 0x10) read(r0, &(0x7f0000000180)=""/223, 0xdf) read(r2, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:37 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r5, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:37 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\t', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 388.112304][ T722] binder_alloc: binder_alloc_mmap_handler: 716 20001000-20004000 already mapped failed -16 [ 388.146400][ T719] binder: BINDER_SET_CONTEXT_MGR already set 12:46:37 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r3, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:37 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xffffff9e, 0x0, {0x8}}, 0x14}}, 0x0) [ 388.234643][ T7669] binder: release 716:719 transaction 234 out, still active [ 388.244697][ T719] binder: 716:719 ioctl 40046207 0 returned -16 [ 388.255660][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 388.269794][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 388.275590][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 388.277369][ T7669] binder: send failed reply for transaction 234, target dead 12:46:37 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x48, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:37 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x4}) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/snapshot\x00', 0x0, 0x0) ioctl$SG_GET_PACK_ID(r2, 0x227c, &(0x7f0000000100)) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:37 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xfffffff0, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:37 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\n', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:37 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r5, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:37 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r3, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:37 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x40030000000000, 0x0, {0x8}}, 0x14}}, 0x0) [ 388.533311][ T755] binder: 751:755 ioctl c0306201 20000400 returned -14 12:46:37 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\v', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:37 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) prctl$PR_GET_NAME(0x10, &(0x7f0000000400)=""/104) read(r0, &(0x7f0000000180)=""/223, 0xdf) r2 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/net/pfkey\x00', 0x12002, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f00000003c0)={0x0, 0x3}, &(0x7f0000000380)=0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(r2, 0x84, 0x6c, &(0x7f00000002c0)={r3, 0x4d, "83b0fef52a2dd77ea2cc6456d24645a2aa475eef98ac033282ce50088e2bd95d46834d00973a85299576bed49a8bc1a74ef2d2c8011ee4bf34b1bbb24e9f6f40773af9d9d5ecae3f3687404f99"}, &(0x7f0000000340)=0x55) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:37 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xf0ffffffffffff, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:37 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r3, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:37 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) r5 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r5, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 388.829825][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 388.835896][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 389.069806][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 389.075631][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 389.079821][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 389.087101][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 389.315102][ T795] binder_alloc: binder_alloc_mmap_handler: 751 20001000-20004000 already mapped failed -16 [ 389.325343][ T794] binder: BINDER_SET_CONTEXT_MGR already set [ 389.333114][ T794] binder: 751:794 ioctl 40046207 0 returned -16 [ 389.336896][ T795] binder_alloc: 751: binder_alloc_buf, no vma [ 389.345530][ T795] binder: 751:795 transaction failed 29189/-3, size 0-0 line 3147 [ 389.354100][ T795] binder: 751:795 ioctl c0306201 20000400 returned -14 12:46:38 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x4c, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:38 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x100000000000000, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:38 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\f', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:38 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) socket$inet6_sctp(0xa, 0x10000000005, 0x84) r2 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r2, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:38 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$LOOP_SET_STATUS64(r0, 0x4c04, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x5, 0xd0, 0x0, 0xb, 0x12, 0x10, "ba71bbe5648580b361bd791e6049b35de8448e7652908f974b9959b36dcce99f89658308382be4f498ae00d9254115624632d0877ace39f6709f1434d8bb4272", "548db3cdcfe5e7af04bacf4802b8356c69255ee44b622716c28ca2689dd4c21606317024b2eee808e3936f3013f10dc98fcbc4a82a1a3ac57c2d4ed59ad34126", "a385a3b10c69a1d237b967e33b4ac53d0f949a9e0198f3768b3f3ba9608068d1", [0x2, 0x7ff]}) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:38 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r4, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 389.361879][ T7669] binder: release 751:755 transaction 236 out, still active [ 389.369204][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 389.382042][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 389.417558][ T7669] binder: send failed reply for transaction 236, target dead 12:46:38 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\r', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:38 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x200000000000000, 0x0, {0x8}}, 0x14}}, 0x0) [ 389.496397][ T810] binder: 808:810 ioctl c0306201 20000400 returned -14 12:46:38 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r2, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:38 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000100)='/dev/full\x00', 0x100, 0x0) ioctl$sock_proto_private(r1, 0x89e9, &(0x7f0000000280)="1fd2842adbd79ca25792564ef6fba1a9f940a47920f9a597afe51d5483c131450f7e9be4b1820593cf3cd295a78ec3b65e3f885a383cbc269b97f4a1b4c345a313d71dd91775562196c3717581f750fc77e46c40ab60c30f6e2a1a54e548acd32eb672f30ca6266c7dda7a11e46085028ddfedb461739b4fe1cc333eda2d94edc2b8897c6ebc0d3bf81ad158af817272186f70f8463a6e657d76581a8012ab81e30b2ef2a737c7fbd63522ecc1e0f3d43c6b937f88f3f00bd05758244b20f7dd5d87750131ae") r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000001680)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r2, &(0x7f0000465f8e)=""/114, 0x72) getsockopt$IP6T_SO_GET_REVISION_TARGET(r1, 0x29, 0x45, &(0x7f0000000040)={'icmp6\x00'}, &(0x7f00000015c0)=0x1e) r3 = geteuid() syz_mount_image$ntfs(&(0x7f0000000140)='ntfs\x00', &(0x7f0000000380)='./file0\x00', 0x8, 0x1, &(0x7f00000013c0)=[{&(0x7f00000003c0)="1c8f423dce3200786baf8d01677614cca5f8e68700afcc757990ce3418771f8e81fb0c35f6041de9e1380fb0f735401b56eed2c4b8f8a1a1d432690275009e16a44f8d3626d28eb6624eba85673ffdd8f01d84df1504432f5796ff2274d44676cb6e7d7b72f694c6c8aad2182c14e01cdef1c714b13ef2dffe78cedcee1de107008d172a3ec20faad4eb2dfdc58a29e530094d3d7355b44dfcd9a9d59dcd1ffe563c10a0b1b0c2bdd625513dc547db00c3f3111ba105cf72fb37542193bbac7c8ed1cde2bb257557b587bd8cfff515c1f273347f786b82949375b06ff3dfcbcdd1ed9b0535ea9fb1c64f106dbf44c7c8f83980f8b21fd0563372853b3b4d31f5be846bff7a9aff25596457e47cb75ee9603352cedf37cfd53b82b5be728b2802b5aedb79f630c2be8342209af8c0a139c946783a84cc9ff02b0711cd329bbbe3cd63587496f0b109840f7d2e40849538b4a5e781adb212ca60c2cf22565f4b544a40b6715f51ffe2556fe529bd52574c59d28d03f68f737703335c65af000ce055f5a78d3384c31cbbd614713480742ffefc2ec1237f6788cace90c4acaaa77e69f13a924cf2f198ff7ede3da4d99fb4a5e5ffc6fef0381df612e278d85d3b7db48639b42e7823a98a718e75b7562d21fe8622c95a9f91b602154bcdfb29106aa73a2008ae2fde76a0399c1deccd5adcb132729e9214d7541339eb604f8c7806a226cd6dbb6aa94dc5f080c033551f89a440f6dd18ea0bf76b94d3bd62f30f786973dfd4b2ea65c17d7249b095a7ae15c495a1b0b661c3414677332b6a5019c584e93e56980b41a021d98f922f41728f4b120faa700314a9f7432d4f42c7bdb1c8f6e2b6b3ad2b7e79edc436996b2bf04c30c7b6212cc7787223a3fea0dce0d94865088408137954af13e4549bef1c63cf28b95f86d525974f25d88971d296187e8c335593b235c9d68554f704aa83989bedd150979021482ffea05211ea506a23226072bd93b601c7c82b0e8db979196e7b9bebf320582121584d7c93995e2dae15b1618c694a66a12f131057250f4073f577935d637dda504a0f39ea0ccbb018c1d3244e55d1ad796577b0a82b8c3bfab4416f738adda5841912137be0d2ae5b7223b1038e41c07e2920d2b377b501ec9ef35740357ff8372ee13c9061748002609bd69a56138a9157e5f270321812fe05e2f07669627513a715cbe060373013b6128a456f286d0e4f28a906a0b11ee51bc5c2ed828366002fac36c1c26ee09f28aabee6e4ea4bbb93be9cbe4116a91fc0a08c51a704a55cc1e116f056d3e9c6279d4f5038deaaa7cc53190e070b4bbd660de007a67c968ba6a7ab564fffcdd8515f31a2967277b814285ea56837a93db0265702310aba34242edb0f9999cf0f1509ce6fb63d13f836c982fd07c95c2adcd6d4e0f3f1143532f4c0bbfea37932ae87c4864efc7c592f88b31389c071951888d1148673c7c05cde4f0de3a841c2336970e897346716128fca6aa801d0347d3c7d51954444d6caf61cfcc3e15d3c0ca6a2861eab2032d44bce09ea3d26b275fe2deb71aa26c47cb7347ee838bb38cc739d5b20b6286693684921ffe9dc710a942a7450679401e10c8a9d16191b92c4f077ad524400d949df41de70d7337640d86120aa2531c2eebe29ecd8079a935d1638989348257fec54105862e61efcd5d20d5264e1d6eed51c96e1ccb9d441a01dc08e3224f58350dc401682404cfea008805e6a0fe59b5c12c83a85427f0e45352f6a7b85bace1979c9cb2bfc69f7c8758fa4954e8c38d1bf3b54941f48e85d316a8716bdc89a8929f86a3e963f6704ff1e54a8972b7af981999e63f4e393f68b4565cb873a90ec6a6b0986fd17bd5d1e5c9141b956bf638f2264c8d6afe6e5dfc9e69cfce673e9da4d410c045552b3a0040504f9fb6a410d36dad59a56e885994c83bc1f248c3b2d60600b23326f793ce62839c53a4179a6e329f3ad454e94bc98b8b510e6bd22b3c002521805b9851b30ac2c4b7b2eba866fa253f0d993111772b73335b789a7e12e5b05ea06a0754e8da1fb095bcd94b734718f93fad50e5f177d7bd2ef25167f233692ea9eef07630a421199242530869e038563df74a95eef6448b5ca7859f9d10a502f6140afd286d66e21e27caf2f691f9e15c3909418c5c88340f6588ceace4360dfddaff63e391103ad496f413480476a0c6f91c636a2b5c71f503fa2582702d60c3194ba4d8d776f85bc5fbec77a04a3550c2cc62c8e13ce55b18c89e68c2a2d25018cbdbac0bdd8b1321868a9964be4853703da7826530180532af3f521bf9b46306f7157add2f684df806a8a3a43084ce666d8ea247e5ca0db4dd144108c2ac4e2c28b120d2dfdf9e6b0b33eb083e3af54116028a24f574c7d4f7989905ae079a34f913f03e4625af93341dc5f1794c022d31312aaad58236fee35ddd8345b6b05046a39d467e410d3d132a01c394fad7d62df7e105d8711726e0471650edab8da204c0b7e998a7a78b83782e5aa11ebc3bf57e86a1a1f94a0ced0c087cc05bd119862a26b2aa9592ecb7422cb9afc34217eccb6cc6c35f930994b824b0387b60b0f9947940cc4adbbac526b92ac44561b77cae9b809fd2a54d5d88792a6010c4dd5a256d024615a8e824cc53a2149760e5ebe2841d77aa14bbb426014d5e224ec3b03f9ccceea2cfa4dac8c9484b47ed927fbb7bc785a3115cbebd594c1411f094485357b6637b2603fdcf4a8d963d9aac7a254f8a92ae36dd08b0080bc88390208b1642da64953b7bf5db06365f5376229e8ddc3c00387e63460a13c6b3bc72f9c0ffa3ae3729265e9951906cbe1a0ba9ac002f28978cacdf684f2a26f525466027d102b3ca9023f2df57414b8ffb44bec37bfc3b2cf41031f9a65deeb94188c380ee48a65237a61348504311760ff9320f87a1fe6fc997f444a97595d859a2428e1d7f9dd055a1e6020ea85d067662ab56e88abddc28f2514a52475e3dca696ca4950c0262adfa6030442a730bbc49de2ed681e546458b31a6c1a089b002725049cf7394584c3108cf0c2a87ee152b5b372a5ae94ed3b6c9da5d38e6a90e5139474882e2cfe1690d39266da37174d4ccf70144849bbe83eea25691ed5fe646667826212d15a5cfbd57a224c6541bf3ddd81d7b72f269c7daab47e70ffab25a7d38096b0b944e20750bf9be444b7212e0886347896834de0362da6a6308fc46345acce30ef835f7b81353576861fa666c62b205f83892652b9b685cff531a203dd2b3ba3250cc87544fcfa7d72abb7eb9f4bb991e288936997125d398d826604fd59cce104f7d06ab2e567d1a90b02fc03a7f23580ee77c823d285f86088418777c0ec2236573a485c978bce87cf9f66eeb3b46be0bbcaad76c48c0fadeecd5d00855992c8ae9223273d38b505cf21a5f1bb69636e3eb55d5c0f3bc63034ed614efa06b17341a9e8bf08377fd3c0ac5ddd7d2d912b5652ec695b240cdb436523ef254138aaa3496a8aaf608a674c0dc3248fc4398c72a6183d368ef72f892efb40d64ea6a25c21e929374803247e854da28a3d0f0bea59adf326535d2664c065b33d019aaf49e48cbd2ad57f090a3a8c059aa5785ad2f12f0682b5f1fec021af172b58c6a8d641e6b0691aeac42c94cbecbbeefba6acf2fdd5e53865b83adb54fa9a859c0375ee7cfeb018291a2d3d00c4004b5659cfc4c6efa588d623fe72057a14d22ede832ea5bd98e73df815d42dbe37839ef1775b5ae2c27576639f5bd774d33d198e5a1cff337bf6a36fad82ed557aa5408f612dd66ebf97963a9ff34a87c8b44669c85c167d46950c2d975fa2d0d7a6e3740267bd8ee47e1b5c795776a72e3e53bc0afd56f0ab0255c8a0e048115744959c025664d7a5b8fb8b8f7112601bc809be5083320800de0cd9813ee16de585e294ddc9bf8efcc6b3930a911ac22bb86a0d217b2d4059008b7574b090d6c7864a559787ceb12648ab7e6e70a20e68ac76d3b7cec6a928ce1a33befdfe30efe288ed4553ec9b2fd91a96ead4674c826ba84088b443bd71ca7d1cd968e3da2f121c20515524aaa45649b9df9082ac93303adab94a46fc241c0ef5ca6438309a7355b804d6e85c4367dc6f9a19b159fadaa9abbaec9f57dc3fe8221b8bfb222d641fa221c4b31190b48326d5b17f46225ba9375fcce0bcd59140a13d9bf7f179fd3535e0917fe9023ff5956e1ed762bdf9dc3baf4bc3551ab306eafbe046295b991e0e86b8731a7dbab04495fde0cd6aea0c432e257ea10f5abecbac3562cdc97f374773addf4244c60e41c6e38ddc7397f8233dc689c8c67c99743f676f97efbde3c1600de5886465dccedb97a0b6170030ee9f02127e12b1b0f78b319431d2a238e979cf0cfc3820fea361b93dd57e9685e50f2e7c23e332fe981c3776f2899176939a36a76910cff1e2dc3e1c21dcc9c26504de124f7f245f54f36b961d510b8b0dcbe851c8b1161acf177a7c6489611c2bfaeb8652762e2b090365056c48f580569eb7c2858f41f723fd6f8595a8ca6894919ec3642abacfb163d576809278b578fc26bc8544acb43e1343160bc3a8dcb963864f17d040370b699cdd0ee65ceb54960a2d86cb9016a546d35419677528792b86ebef10202a5dc682525a72aa796d7105943e39a5955dbef7bc2b8210e8ffa4892b25d751f3a5a068b36482570cfb8afb546d46e2d913cbb60e9dd64379eebeb7fe918bba2e7caf23a8f7faad9c324503d9b7370d3c3f689d92b0fadc60896cacd80ddb44f97fe24327235a612a63aecebd79e997c6082936f9a2aaf39f980fc776016a9c4565936c14e4a7271f5aedd39039982ba2cdc59679fec9c8de42dc92927a96cc49d9cc15ab6c46124e617fe686b62b90c515dd6bb188d8f035090be17434500d5dd18ce14ab5a8c5ebbaeab64867ba7474ae41e68209b0cc536ec34222e1a153a17fa34c74b07f1961e08f4be2927eacafd1241bf5d7e89007a540356109c6b4b3323041f6827e8618493ddf977ca39447000f46c975b61be1d93a52c16acf7946d3f9b6e83629b745c99024732e64cde662c478cb705e5e92bb474e506e204cccd5f311e06a37f45200a631d17b4c3bfec3798ff112e106f1ca58c4a5e811f5d8e974cb6b5c303223d4374cee1dd3ea86bf636f1f9aba53846729379683f6830b067098cee95f8eb400a6f450db66466a20fc33232ce4d716be5cff51a2ea48222eff5ac84ca002b15711e98fca9a9470aa9309ea2a02ccf75e90fc0a69e82a29e14c545d3b194f84cf3fb34a850441ef3a10a802267f6a2bef98fd05c88c1ac86719d803d4153cda1e57140ad4f7bc22b9f91fb0fd119c445bcb169d58c0aab6b33729883ecc69e7a55c03bbf14bbed7b0a2b6d69f4de71ba9e70143c2367245aad685c65bee6c94ddfff6d7051684b85a160fc1abde0570a94fe03c436e9cd850fea186b2cc49b228c574d51bff37f213a8482b47df5f6e7e869121e29c7699c546ccea63bd5b7463d0ec03de8ea75297e031f7ed6c1831c85e6272c56ec790262817d4a1f2c64f0f627da4dd65cf96d6bd7e36a42cd87c73b7a585db9594c31944a52a1dda810a5bc236b788af27888bcc920ac228018b1e03eaf66a0f931453eeba2d458b2c2fa52d4d75f301ae32521746f6082fb9e89397b6b4b52149a682a7258daa4d9ec418c328369df32ee78dfe93d6cc9cf37eb7b1ea8ea1a14096eecea58bf71060fdc44151ccc9e986bf941fe8b2602f0173f286d1380bfea98f6491ec6c", 0x1000, 0x1f}], 0x200000, &(0x7f0000001400)={[{@umask={'umask', 0x3d, 0x6}}, {@show_sys_files_no='show_sys_files=no'}, {@show_sys_files_yes='show_sys_files=yes'}, {@errors_continue='errors=continue'}, {@errors_remount='errors=remount-ro'}, {@umask={'umask', 0x3d, 0x6618}}], [{@uid_gt={'uid>', r3}}, {@obj_type={'obj_type', 0x3d, '/dev/full\x00'}}, {@obj_role={'obj_role'}}, {@subj_type={'subj_type', 0x3d, 'wlan0'}}, {@subj_type={'subj_type', 0x3d, ')trustedlo'}}]}) fstat(r0, &(0x7f0000001540)) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) ioctl$KVM_ASSIGN_DEV_IRQ(r1, 0x4040ae70, &(0x7f0000001500)={0x3, 0x6c98a06c000000, 0xfffffffffffffffc, 0x2}) 12:46:38 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r4, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:38 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x400000000000000, 0x0, {0x8}}, 0x14}}, 0x0) [ 389.856324][ T831] ntfs: (device loop2): parse_options(): Unrecognized mount option uid>00000000000000000000. [ 389.880741][ T831] ntfs: (device loop2): parse_options(): Unrecognized mount option obj_type. [ 389.959345][ T840] ntfs: (device loop2): parse_options(): Unrecognized mount option uid>00000000000000000000. [ 389.981552][ T840] ntfs: (device loop2): parse_options(): Unrecognized mount option obj_type. [ 390.282230][ T848] binder_alloc: binder_alloc_mmap_handler: 808 20001000-20004000 already mapped failed -16 [ 390.292557][ T848] binder: BINDER_SET_CONTEXT_MGR already set [ 390.298572][ T848] binder: 808:848 ioctl 40046207 0 returned -16 [ 390.298620][ T849] binder_alloc: 808: binder_alloc_buf, no vma [ 390.311114][ T849] binder: 808:849 transaction failed 29189/-3, size 0-0 line 3147 [ 390.318940][ T849] binder: 808:849 ioctl c0306201 20000400 returned -14 12:46:39 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x60, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:39 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:39 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x11', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:39 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x800000000000000, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:39 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r4, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:39 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) r2 = fcntl$dupfd(r1, 0x406, r1) ioctl$DRM_IOCTL_ADD_BUFS(r2, 0xc0206416, &(0x7f0000000100)={0x401, 0x166d, 0x1, 0x7, 0x5, 0x7}) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 390.326155][ T7669] binder: release 808:810 transaction 239 out, still active [ 390.333763][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 390.339655][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 390.345972][ T7669] binder: send failed reply for transaction 239, target dead 12:46:39 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xa00000000000000, 0x0, {0x8}}, 0x14}}, 0x0) [ 390.471457][ T863] binder: 861:863 ioctl c0306201 20000400 returned -14 12:46:39 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:39 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r4, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:39 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay:', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:39 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000100)={r0, 0x0, 0x1000, 0xffffffffffffff73, 0x2}) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:39 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xe00000000000000, 0x0, {0x8}}, 0x14}}, 0x0) [ 391.238142][ T896] binder_alloc: binder_alloc_mmap_handler: 861 20001000-20004000 already mapped failed -16 [ 391.248499][ T895] binder: BINDER_SET_CONTEXT_MGR already set [ 391.254663][ T895] binder: 861:895 ioctl 40046207 0 returned -16 [ 391.261107][ T896] binder_alloc: 861: binder_alloc_buf, no vma [ 391.267218][ T896] binder: 861:896 transaction failed 29189/-3, size 0-0 line 3147 [ 391.275133][ T896] binder: 861:896 ioctl c0306201 20000400 returned -14 12:46:40 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x68, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:40 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:40 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xf00000000000000, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:40 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlayH', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:40 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) r4 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r4, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:40 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='net/if_inet6\x00') setsockopt$RXRPC_SECURITY_KEYRING(r2, 0x110, 0x2, &(0x7f0000000280)='/dev/binder#\x00', 0xd) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000140)={{&(0x7f0000137000/0x4000)=nil, 0x4000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) syz_open_dev$binder(&(0x7f0000000100)='/dev/binder#\x00', 0x0, 0x800) syz_open_dev$vbi(&(0x7f00000002c0)='/dev/vbi#\x00', 0x0, 0x2) [ 391.282374][ T3486] binder: release 861:863 transaction 242 out, still active [ 391.299751][ T3486] binder: undelivered TRANSACTION_COMPLETE [ 391.326350][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 [ 391.352176][ T3486] binder: send failed reply for transaction 242, target dead 12:46:40 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:40 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x1000000000000000, 0x0, {0x8}}, 0x14}}, 0x0) [ 391.411709][ T911] binder: 906:911 ioctl c0306201 20000400 returned -14 12:46:40 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlayL', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:40 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) r3 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r3, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:40 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x6000000000000000, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:40 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 392.204648][ T941] binder_alloc: binder_alloc_mmap_handler: 906 20001000-20004000 already mapped failed -16 [ 392.215301][ T941] binder_alloc: 906: binder_alloc_buf, no vma [ 392.221465][ T941] binder: 906:941 transaction failed 29189/-3, size 0-0 line 3147 [ 392.226766][ T940] binder: BINDER_SET_CONTEXT_MGR already set [ 392.229379][ T941] binder: 906:941 ioctl c0306201 20000400 returned -14 [ 392.235834][ T940] binder: 906:940 ioctl 40046207 0 returned -16 12:46:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x6c, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:41 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\\', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:41 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) r3 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r3, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:41 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x9effffff00000000, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:41 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:41 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) r2 = syz_open_dev$media(&(0x7f0000000100)='/dev/media#\x00', 0x5, 0x2) ioctl$PERF_EVENT_IOC_SET_FILTER(r2, 0x40082406, &(0x7f0000000140)='/dev/cuse\x00') read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) ioctl$VIDIOC_STREAMON(r2, 0x40045612, &(0x7f0000000280)=0x9f5) [ 392.242531][ T3486] binder: release 906:911 transaction 245 out, still active [ 392.259843][ T3486] binder: undelivered TRANSACTION_COMPLETE [ 392.265730][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 [ 392.272592][ T3486] binder: send failed reply for transaction 245, target dead 12:46:41 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xc00e000000000000, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:41 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 392.358532][ T956] binder: 953:956 ioctl c0306201 20000400 returned -14 [ 392.410764][ T959] binder_alloc: binder_alloc_mmap_handler: 953 20001000-20004000 already mapped failed -16 12:46:41 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay`', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:41 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) r3 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r3, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:41 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xfffffe8c) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) r2 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000280)='/dev/mixer\x00', 0x480, 0x0) ioctl$KIOCSOUND(r2, 0x4b2f, 0x800000) read(r1, &(0x7f0000000100)=""/114, 0xfffffffffffffd8c) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 392.472191][ T956] binder: BINDER_SET_CONTEXT_MGR already set [ 392.499495][ T956] binder: 953:956 ioctl 40046207 0 returned -16 [ 392.512469][ T970] binder_alloc: 953: binder_alloc_buf, no vma 12:46:41 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 392.553368][ T970] binder: 953:970 transaction failed 29189/-3, size 0-0 line 3147 [ 392.613016][ T7669] binder: release 953:956 transaction 248 out, still active [ 392.622450][ T970] binder: 953:970 ioctl c0306201 20000400 returned -14 [ 392.639107][ T7669] binder: undelivered TRANSACTION_COMPLETE 12:46:41 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x74, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:41 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xef02000000000000, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:41 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlayh', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 392.656304][ T7669] binder: send failed reply for transaction 248, target dead [ 392.678175][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 12:46:41 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:41 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r3, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 392.819052][ T995] binder: 992:995 ioctl c0306201 20000400 returned -14 12:46:41 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xf0ffffff00000000, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:41 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlayl', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:41 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r3, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:42 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:42 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xffffff7f00000000, 0x0, {0x8}}, 0x14}}, 0x0) [ 392.989827][ C1] net_ratelimit: 18 callbacks suppressed [ 392.989834][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 393.001319][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 393.229791][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 393.229806][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 393.235581][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 393.241344][ C0] protocol 88fb is buggy, dev hsr_slave_1 12:46:42 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x10002, 0x0) 12:46:42 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlayt', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 393.608439][ T1037] binder_alloc: binder_alloc_mmap_handler: 992 20001000-20004000 already mapped failed -16 [ 393.618954][ T1036] binder: BINDER_SET_CONTEXT_MGR already set [ 393.625361][ T1036] binder: 992:1036 ioctl 40046207 0 returned -16 [ 393.625406][ T1037] binder_alloc: 992: binder_alloc_buf, no vma [ 393.639843][ T1037] binder: 992:1037 transaction failed 29189/-3, size 0-0 line 3147 [ 393.647831][ T1037] binder: 992:1037 ioctl c0306201 20000400 returned -14 12:46:42 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x7a, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:42 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0xfffffffffffff000, 0x0, {0x8}}, 0x14}}, 0x0) 12:46:42 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r3, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:42 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:42 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlayz', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:42 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000816000/0x4000)=nil, 0x4000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 393.655090][ T7669] binder: release 992:995 transaction 251 out, still active [ 393.663045][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 393.668947][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 393.675307][ T7669] binder: send failed reply for transaction 251, target dead 12:46:42 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x2, {0x8}}, 0x14}}, 0x0) 12:46:42 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:42 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\xf6', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 393.767418][ T1062] binder: 1059:1062 ioctl c0306201 20000400 returned -14 [ 393.789811][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 393.795598][ C0] protocol 88fb is buggy, dev hsr_slave_1 12:46:42 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r3, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:42 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:43 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x4, {0x8}}, 0x14}}, 0x0) [ 394.029770][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 394.035557][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 394.556257][ T1093] binder_alloc: binder_alloc_mmap_handler: 1059 20001000-20004000 already mapped failed -16 [ 394.566649][ T1092] binder: BINDER_SET_CONTEXT_MGR already set [ 394.573122][ T1092] binder: 1059:1092 ioctl 40046207 0 returned -16 [ 394.576177][ T1093] binder_alloc: 1059: binder_alloc_buf, no vma [ 394.586072][ T1093] binder: 1059:1093 transaction failed 29189/-3, size 0-0 line 3147 [ 394.594249][ T1093] binder: 1059:1093 ioctl c0306201 20000400 returned -14 12:46:43 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x300, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:43 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:43 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) socket$inet6_sctp(0xa, 0x10000000005, 0x84) r2 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r2, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:43 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:43 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x8, {0x8}}, 0x14}}, 0x0) 12:46:43 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) r2 = userfaultfd(0x800) r3 = syz_open_dev$amidi(&(0x7f0000000140)='/dev/amidi#\x00', 0x6, 0x20001) r4 = syz_open_dev$midi(&(0x7f0000000280)='/dev/midi#\x00', 0x7, 0x80) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cgroup.controllers\x00', 0x0, 0x0) ioctl$KVM_IRQFD(r3, 0x4020ae76, &(0x7f0000000300)={r4, 0x1, 0x805, r5}) r6 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0xe0000, 0x0) mmap$binder(&(0x7f000098b000/0x3000)=nil, 0x3000, 0x4, 0x10, r6, 0xffffffffffffffff) getsockopt$IP6T_SO_GET_REVISION_MATCH(r3, 0x29, 0x44, &(0x7f0000000340)={'TPROXY\x00'}, &(0x7f0000000380)=0x1e) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x2}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r2, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 394.601913][ T7669] binder: release 1059:1062 transaction 254 out, still active [ 394.609407][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 394.615367][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 394.621681][ T7669] binder: send failed reply for transaction 254, target dead 12:46:43 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:43 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xa, {0x8}}, 0x14}}, 0x0) [ 394.725444][ T1107] binder: 1102:1107 ioctl c0306201 20000400 returned -14 [ 394.726781][ T1103] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:43 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r2, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:43 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:43 executing program 4: openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:43 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xe, {0x8}}, 0x14}}, 0x0) [ 394.979623][ T1123] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 395.524925][ T1139] binder_alloc: binder_alloc_mmap_handler: 1102 20001000-20004000 already mapped failed -16 [ 395.535207][ T1138] binder: BINDER_SET_CONTEXT_MGR already set [ 395.541863][ T1138] binder: 1102:1138 ioctl 40046207 0 returned -16 [ 395.547648][ T1139] binder_alloc: 1102: binder_alloc_buf, no vma [ 395.554568][ T1139] binder: 1102:1139 transaction failed 29189/-3, size 0-0 line 3147 [ 395.564121][ T1139] binder: 1102:1139 ioctl c0306201 20000400 returned -14 12:46:44 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x500, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:44 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:44 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, 0x0) pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:44 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xf, {0x8}}, 0x14}}, 0x0) 12:46:44 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:44 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cachefiles\x00', 0x10000, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r2, 0x114, 0xa, &(0x7f0000000280)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'], 0x4) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 395.571538][ T7669] binder: release 1102:1107 transaction 257 out, still active [ 395.579014][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 395.594605][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 395.640392][ T7669] binder: send failed reply for transaction 257, target dead [ 395.644528][ T1145] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:44 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x10, {0x8}}, 0x14}}, 0x0) 12:46:44 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 395.717498][ T1154] binder: 1152:1154 ioctl c0306201 20000400 returned -14 12:46:44 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:44 executing program 2: r0 = userfaultfd(0x0) ioctl$UI_BEGIN_FF_ERASE(r0, 0xc00c55ca, &(0x7f0000000100)={0x4, 0x8, 0x9}) r1 = socket$netlink(0x10, 0x3, 0xb) r2 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x200, 0x0) ioctl$KDGETKEYCODE(r2, 0x4b4c, &(0x7f0000000380)={0x0, 0x48000}) setsockopt(r1, 0xffffffff, 0x1000, &(0x7f0000000280)="380d976a4d4c8ab0aca2b6c918c8516582361c373f26ce4ffb758204f0962656160cc0c5e7cfc0ff2d5ce90181e775d7aead3018e3c35b52d12402a9faf561fa7193129ff1698e28c09650872131246eb1a4041518fec3d2746c7205568a18880c319231786cf466b80cb8170293a3b4d461fd96d119d8c74b4c3c699758e62ba4ed2e4320c02ce3ee4949acf0868e064fb26d13a3b79e2587522a4600721ac42ab64e9e630562fb5d07c29f300e8636187c412c90d0ed7244144daeb07b787d2fdc97e067688c2a19b627b670e42f80146c4662797888b277ae43e9ae2d6ae0f5d45c2cd665eb", 0xe7) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r3 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) fstat(r2, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r2, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = getgid() getsockopt$sock_cred(r2, 0x1, 0x11, &(0x7f0000000840)={0x0, 0x0, 0x0}, &(0x7f0000000880)=0x2) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000700)={0x0, 0x8c, &(0x7f0000000640)=[@in6={0xa, 0x4e20, 0x0, @mcast1, 0x2f}, @in6={0xa, 0x4e23, 0x401, @empty, 0x4}, @in6={0xa, 0x4e22, 0x4, @dev={0xfe, 0x80, [], 0x14}, 0x7ff}, @in6={0xa, 0x4e20, 0x0, @mcast2}, @in6={0xa, 0x4e20, 0x4, @initdev={0xfe, 0x88, [], 0x0, 0x0}, 0x7}]}, &(0x7f0000000740)=0x10) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000000780)={r8, 0xffffffff}, &(0x7f00000007c0)=0x8) fsetxattr$system_posix_acl(r1, &(0x7f00000003c0)='system.posix_acl_access\x00', &(0x7f0000000580)={{}, {0x1, 0x2}, [{0x2, 0x7, r4}], {0x4, 0x4}, [{0x8, 0x4, r5}, {0x8, 0x2, r6}, {0x8, 0x3, r7}], {0x10, 0x1}, {0x20, 0x5}}, 0x44, 0x1) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r3, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) fcntl$F_SET_FILE_RW_HINT(r1, 0x40e, &(0x7f0000000600)) [ 395.790306][ T1161] binder_alloc: binder_alloc_mmap_handler: 1152 20001000-20004000 already mapped failed -16 12:46:44 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, 0x0) pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 395.836913][ T1154] binder: BINDER_SET_CONTEXT_MGR already set [ 395.859598][ T1154] binder: 1152:1154 ioctl 40046207 0 returned -16 12:46:44 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x60, {0x8}}, 0x14}}, 0x0) [ 395.892823][ T1169] binder_alloc: 1152: binder_alloc_buf, no vma [ 395.931289][ T1169] binder: 1152:1169 transaction failed 29189/-3, size 0-0 line 3147 [ 395.937203][ T7669] binder: release 1152:1154 transaction 260 out, still active [ 395.948166][ T1169] binder: 1152:1169 ioctl c0306201 20000400 returned -14 [ 395.968832][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 395.977176][ T1174] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x600, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:45 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 395.991752][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 396.005789][ T7669] binder: send failed reply for transaction 260, target dead [ 396.021622][ T1174] overlayfs: filesystem on './file0' not supported as upperdir 12:46:45 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xf0, {0x8}}, 0x14}}, 0x0) 12:46:45 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:45 executing program 2: r0 = userfaultfd(0x0) r1 = syz_open_dev$sndpcmc(&(0x7f0000000100)='/dev/snd/pcmC#D#c\x00', 0x5, 0x20000) setsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000140), 0x4) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r2, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:45 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, 0x0) pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 396.158044][ T1193] binder: 1190:1193 ioctl c0306201 20000400 returned -14 12:46:45 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 396.213056][ T1203] binder_alloc: binder_alloc_mmap_handler: 1190 20001000-20004000 already mapped failed -16 12:46:45 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x2ef, {0x8}}, 0x14}}, 0x0) [ 396.276530][ T1206] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 396.286293][ T1193] binder: BINDER_SET_CONTEXT_MGR already set [ 396.308848][ T1193] binder: 1190:1193 ioctl 40046207 0 returned -16 12:46:45 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 396.329247][ T1213] binder_alloc: 1190: binder_alloc_buf, no vma [ 396.361391][ T3486] binder: release 1190:1193 transaction 263 out, still active [ 396.368924][ T3486] binder: undelivered TRANSACTION_COMPLETE 12:46:45 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:45 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xa00, {0x8}}, 0x14}}, 0x0) 12:46:45 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 396.375496][ T1213] binder: 1190:1213 transaction failed 29189/-3, size 0-0 line 3147 [ 396.398809][ T3486] binder: send failed reply for transaction 263, target dead [ 396.411049][ T1213] binder: 1190:1213 ioctl c0306201 20000400 returned -14 [ 396.424987][ T7660] binder: undelivered TRANSACTION_ERROR: 29189 12:46:45 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x700, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:45 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) r2 = syz_open_dev$radio(&(0x7f0000000380)='/dev/radio#\x00', 0x2, 0x2) ioctl$TIOCPKT(r2, 0x5420, &(0x7f00000003c0)=0x9) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000500)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) r3 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x0, 0x0) r4 = syz_genetlink_get_family_id$nbd(&(0x7f0000000280)='nbd\x00') sendmsg$NBD_CMD_RECONFIGURE(r3, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000300)={&(0x7f0000000400)=ANY=[@ANYBLOB="28000000860589a47d41bf4270f471b7b59dd10001b13b82fcac8266249bb9eb58cac58fac8851508211396aa8ab6e64ab5d4d1b440d45bfec47f9d7442c40b50fe7e50100010000000000195570820e360c513037211a979fb092fa57525bb538b9b95ec56585bb64949807faecc7598ec95f418ed1514c0fc3e377f6d445dcfd5548ef62987b6a5bc033a4cf4c5fe6908d198277f5ed1443e3f29c2ab1f5e69f3fca191d05e307b81d9c81dba377a9bd2012cfd4b8a9372a00a431ac495c02824ac7add33c0e629f339d06ad9a", @ANYRES16=r4, @ANYBLOB="000629bd7000ffdbdf250300000008000100000000000c0008000400000000000000"], 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x40040) 12:46:45 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 396.537545][ T1226] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:45 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xe00, {0x8}}, 0x14}}, 0x0) 12:46:45 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 396.590311][ T1234] binder: 1233:1234 ioctl c0306201 20000400 returned -14 12:46:45 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:45 executing program 2: r0 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vsock\x00', 0x40001, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f0000000140)=@req3={0x86, 0x1, 0x1, 0x0, 0x400, 0xfffffffffffffffa, 0x4}, 0x1c) r1 = userfaultfd(0x0) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f00000000c0)) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r1, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r2, &(0x7f0000465f8e)=""/114, 0x72) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0)='TIPCv2\x00') sendmsg$TIPC_NL_PEER_REMOVE(r2, &(0x7f00000005c0)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x400010}, 0xc, &(0x7f0000000580)={&(0x7f0000000300)={0x26c, r3, 0x24, 0x70bd29, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x68, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4950}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000001}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x55d4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_NODE={0x3c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7fff}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x40}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x3}]}, @TIPC_NLA_MEDIA={0x60, 0x5, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}, @TIPC_NLA_BEARER={0xc, 0x1, [@TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x8}]}, @TIPC_NLA_BEARER={0x40, 0x1, [@TIPC_NLA_BEARER_PROP={0x24, 0x2, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000000}]}, @TIPC_NLA_BEARER_NAME={0x10, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_DOMAIN={0x8, 0x3, 0x200}]}, @TIPC_NLA_NET={0x50, 0x7, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x81}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x80000000}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x4000000000000000}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xfff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xfffffffffffffffc}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x40}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}]}, @TIPC_NLA_NODE={0x1c, 0x6, [@TIPC_NLA_NODE_ADDR={0x8}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x7fffffff}]}, @TIPC_NLA_NET={0x3c, 0x7, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xae}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x66}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x3}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0xdce}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x800}]}, @TIPC_NLA_MEDIA={0x60, 0x5, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xffffffffffffffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1c}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x79bf}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0x26c}, 0x1, 0x0, 0x0, 0x20000000}, 0xfb8daa0d90e2b1c8) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:45 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:45 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:45 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xec0, {0x8}}, 0x14}}, 0x0) [ 396.773608][ T1250] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:45 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:45 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, 0x0, 0x0, 0x0) [ 397.062499][ T1272] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 397.375676][ T1277] binder_alloc: binder_alloc_mmap_handler: 1233 20001000-20004000 already mapped failed -16 [ 397.385980][ T1276] binder: BINDER_SET_CONTEXT_MGR already set [ 397.393185][ T1276] binder: 1233:1276 ioctl 40046207 0 returned -16 [ 397.399947][ T1277] binder_alloc: 1233: binder_alloc_buf, no vma [ 397.406185][ T1277] binder: 1233:1277 transaction failed 29189/-3, size 0-0 line 3147 [ 397.414286][ T1277] binder: 1233:1277 ioctl c0306201 20000400 returned -14 12:46:46 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xf00, {0x8}}, 0x14}}, 0x0) 12:46:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x2000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:46 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:46 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, 0x0, 0x0, 0x0) 12:46:46 executing program 2: r0 = userfaultfd(0x0) r1 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x1a) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000340)='team\x00') getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffff9c, 0x0, 0x10, &(0x7f0000000640)={{{@in, @in6=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@dev}, 0x0, @in=@dev}}, &(0x7f0000000740)=0xe8) recvmsg(0xffffffffffffffff, &(0x7f0000000b00)={&(0x7f0000000780)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, 0x80, &(0x7f0000000a00)=[{&(0x7f0000000800)=""/56, 0x38}, {&(0x7f0000000840)=""/231, 0xe7}, {&(0x7f0000000940)=""/29, 0x1d}, {&(0x7f0000000980)=""/100, 0x64}], 0x4, &(0x7f0000000a40)=""/138, 0x8a}, 0x10000) getsockopt$inet6_IPV6_IPSEC_POLICY(0xffffffffffffff9c, 0x29, 0x22, &(0x7f0000000c00)={{{@in6=@initdev, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast2}, 0x0, @in6=@ipv4={[], [], @local}}}, &(0x7f0000000d00)=0xe8) ioctl$sock_SIOCGIFINDEX(0xffffffffffffff9c, 0x8933, &(0x7f0000000d40)={'ifb0\x00', 0x0}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000d80)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @remote}, &(0x7f0000000dc0)=0x14) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000000ec0)={{{@in=@multicast1, @in6=@ipv4={[], [], @remote}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@dev}, 0x0, @in=@broadcast}}, &(0x7f0000000fc0)=0xe8) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000380)='/dev/dlm_plock\x00', 0x240000, 0x0) accept(0xffffffffffffff9c, &(0x7f0000001080)=@ll={0x11, 0x0, 0x0}, &(0x7f0000001100)=0x80) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f00000013c0)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001380)={&(0x7f0000001140)={0x234, r2, 0x1, 0x70bd2c, 0x25dfdbff, {}, [{{0x8, 0x1, r3}, {0x44, 0x2, [{0x40, 0x1, @queue_id={{{0x24, 0x1, 'queue_id\x00'}, {0x8}, {0x8, 0x4, 0x800}}, {0x8, 0x6, r4}}}]}}, {{0x8, 0x1, r5}, {0x7c, 0x2, [{0x3c, 0x1, @user_linkup_enabled={{{0x24, 0x1, 'user_linkup_enabled\x00'}, {0x8}, {0x4}}, {0x8, 0x6, r6}}}, {0x3c, 0x1, @lb_tx_method={{0x24, 0x1, 'lb_tx_method\x00'}, {0x8}, {0xc, 0x4, 'hash\x00'}}}]}}, {{0x8, 0x1, r7}, {0xfc, 0x2, [{0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'loadbalance\x00'}}}, {0x40, 0x1, @name={{0x24, 0x1, 'mode\x00'}, {0x8}, {0x10, 0x4, 'broadcast\x00'}}}, {0x38, 0x1, @mcast_rejoin_interval={{0x24, 0x1, 'mcast_rejoin_interval\x00'}, {0x8}, {0x8, 0x4, 0x1}}}, {0x40, 0x1, @lb_port_stats={{{0x24, 0x1, 'lb_port_stats\x00'}, {0x8}, {0x8, 0x4, 0x3}}, {0x8, 0x6, r8}}}]}}, {{0x8, 0x1, r9}, {0x44, 0x2, [{0x40, 0x1, @lb_hash_stats={{{0x24, 0x1, 'lb_hash_stats\x00'}, {0x8}, {0x8, 0x4, 0xb95}}, {0x8}}}]}}]}, 0x234}, 0x1, 0x0, 0x0, 0x4000010}, 0x4000000) r10 = open(&(0x7f0000000100)='./file0\x00', 0x0, 0x12) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r10, 0x40505412, &(0x7f0000000280)={0x5, 0x400, 0xe700000000000000, 0x0, 0x17}) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r11 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r11, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:46 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 397.421605][ T7660] binder: release 1233:1234 transaction 266 out, still active [ 397.429100][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 397.435449][ T7660] binder: undelivered TRANSACTION_ERROR: 29189 [ 397.441979][ T7660] binder: send failed reply for transaction 266, target dead 12:46:46 executing program 3: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:46 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x6000, {0x8}}, 0x14}}, 0x0) 12:46:46 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, 0x0, 0x0, 0x0) [ 397.551004][ T1289] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 397.573101][ T1291] binder: 1286:1291 ioctl c0306201 20000400 returned -14 12:46:46 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay ', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 397.652486][ T1301] binder_alloc: binder_alloc_mmap_handler: 1286 20001000-20004000 already mapped failed -16 12:46:46 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:46 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) openat$vnet(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vhost-net\x00', 0x2, 0x0) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f000054b000/0x1000)=nil, 0x1000}, 0xfffffffffffffffd}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 397.717494][ T1291] binder: BINDER_SET_CONTEXT_MGR already set 12:46:46 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xc00e, {0x8}}, 0x14}}, 0x0) [ 397.767854][ T1291] binder: 1286:1291 ioctl 40046207 0 returned -16 [ 397.794076][ T1313] binder_alloc: 1286: binder_alloc_buf, no vma [ 397.820146][ T7669] binder: release 1286:1291 transaction 269 out, still active [ 397.830794][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 397.841907][ T1313] binder: 1286:1313 transaction failed 29189/-3, size 0-0 line 3147 [ 397.850747][ T7669] binder: send failed reply for transaction 269, target dead [ 397.875915][ T1313] binder: 1286:1313 ioctl c0306201 20000400 returned -14 [ 397.901320][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 12:46:46 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x3f00, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:46 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180), 0x0, 0x0) 12:46:46 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:46 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xef02, {0x8}}, 0x14}}, 0x0) 12:46:46 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:47 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180), 0x0, 0x0) 12:46:47 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xf000, {0x8}}, 0x14}}, 0x0) [ 398.032124][ T1331] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 398.062432][ T1335] binder: 1332:1335 ioctl c0306201 20000400 returned -14 12:46:47 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:47 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 398.189812][ C0] net_ratelimit: 22 callbacks suppressed [ 398.189819][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 398.201296][ C0] protocol 88fb is buggy, dev hsr_slave_1 12:46:47 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 398.252342][ T1350] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 398.669781][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 398.675587][ C1] protocol 88fb is buggy, dev hsr_slave_1 12:46:47 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) r2 = syz_open_dev$vbi(&(0x7f0000000140)='/dev/vbi#\x00', 0x2, 0x2) ioctl$UI_END_FF_ERASE(r2, 0x400c55cb, &(0x7f0000000280)={0x3, 0x10001, 0xfffffffffffffff9}) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000252000/0x1000)=nil, 0x1000}, 0x3}) open(&(0x7f0000000100)='./file0\x00', 0x440, 0x20) getpeername$packet(r2, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000300)=0x14) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:47 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180), 0x0, 0x0) [ 398.834411][ T1367] binder_alloc: binder_alloc_mmap_handler: 1332 20001000-20004000 already mapped failed -16 [ 398.844744][ T1366] binder: BINDER_SET_CONTEXT_MGR already set [ 398.852016][ T1366] binder: 1332:1366 ioctl 40046207 0 returned -16 [ 398.858543][ T1367] binder_alloc: 1332: binder_alloc_buf, no vma [ 398.868425][ T1367] binder: 1332:1367 transaction failed 29189/-3, size 0-0 line 3147 [ 398.876638][ T1367] binder: 1332:1367 ioctl c0306201 20000400 returned -14 12:46:47 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x4800, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:47 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x34000, {0x8}}, 0x14}}, 0x0) 12:46:47 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x10', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:47 executing program 3: openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:47 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{0x0}], 0x1, 0x0) [ 398.884275][ T7660] binder: release 1332:1335 transaction 272 out, still active [ 398.891821][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 398.897702][ T7660] binder: undelivered TRANSACTION_ERROR: 29189 [ 398.903976][ T7660] binder: send failed reply for transaction 272, target dead 12:46:48 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x400300, {0x8}}, 0x14}}, 0x0) 12:46:48 executing program 3: openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:48 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:48 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{0x0}], 0x1, 0x0) [ 399.066609][ T1385] binder: 1381:1385 ioctl c0306201 20000400 returned -14 12:46:48 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xf0ffff, {0x8}}, 0x14}}, 0x0) [ 399.169577][ T1393] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 399.229919][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 399.235818][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 399.469788][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 399.475596][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 399.479817][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 399.487115][ C0] protocol 88fb is buggy, dev hsr_slave_1 12:46:48 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000100)={0x0, 0x7, 0x9, 0xba, 0x8}) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:48 executing program 3: openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r0, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 399.844788][ T1416] binder_alloc: binder_alloc_mmap_handler: 1381 20001000-20004000 already mapped failed -16 [ 399.855046][ T1415] binder: BINDER_SET_CONTEXT_MGR already set [ 399.862172][ T1415] binder: 1381:1415 ioctl 40046207 0 returned -16 [ 399.868682][ T1416] binder_alloc: 1381: binder_alloc_buf, no vma [ 399.875812][ T1416] binder: 1381:1416 transaction failed 29189/-3, size 0-0 line 3147 [ 399.884123][ T1416] binder: 1381:1416 ioctl c0306201 20000400 returned -14 12:46:48 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x4c00, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:48 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x1000000, {0x8}}, 0x14}}, 0x0) 12:46:48 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{0x0}], 0x1, 0x0) 12:46:48 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:48 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, 0x0) pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:48 executing program 2: r0 = userfaultfd(0x80800) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 399.893176][ T7660] binder: release 1381:1385 transaction 275 out, still active [ 399.901357][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 399.907246][ T7660] binder: undelivered TRANSACTION_ERROR: 29189 [ 399.913545][ T7660] binder: send failed reply for transaction 275, target dead [ 399.987565][ T1422] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 400.021852][ T1430] binder: 1429:1430 ioctl c0306201 20000400 returned -14 12:46:49 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x2000000, {0x8}}, 0x14}}, 0x0) 12:46:49 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)}], 0x1, 0x0) 12:46:49 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, 0x0) pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:49 executing program 2: r0 = userfaultfd(0x0) ioctl$FIDEDUPERANGE(r0, 0xc0189436, &(0x7f0000000440)=ANY=[@ANYBLOB="000200000000000005000000000000000300000000000000", @ANYRES32=r0, @ANYBLOB="00102e34b8650000a64e00000000000000000001000000f112290000", @ANYRES32=r0, @ANYBLOB="00000000010400000000000000000000000000000000000000000000", @ANYRES32=r0, @ANYBLOB="005a940a49ed0f3cf7aef1e2fd352bb7c0de5aa900000072d0b3917c05898e000038fd8e1fd13b6370949a9b456d50d46e518c5a2e943f0b4188d0e8a848dafdbd352980fc6735297d99af1694b90c1ea9ca9f894728bee2f6edb8d555ca1751ff745cb7e7a40dfc95e0418737d4569141431e0580e910ac58b631e2fbfe9724"]) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) ioctl$FS_IOC_FSGETXATTR(r0, 0x801c581f, &(0x7f0000000380)={0x92, 0xffff, 0x5, 0x3, 0x100000000000080}) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) r2 = syz_open_dev$mouse(&(0x7f0000000700)='/dev/input/mouse#\x00', 0x9, 0x800) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000740)=[@in6={0xa, 0x4e20, 0x66fb, @rand_addr="7d3bb75e5c1c1b6ad5cf4ba35337610e"}, @in={0x2, 0x4e22, @multicast1}, @in={0x2, 0x4e21, @broadcast}, @in={0x2, 0x4e21, @remote}, @in6={0xa, 0x4e24, 0xffffffffffffffc1, @loopback, 0x80000001}, @in={0x2, 0x4e22, @empty}, @in6={0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, [], 0x15}, 0x8001}, @in6={0xa, 0x4e20, 0xff, @mcast2, 0x20}, @in={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x15}}, @in6={0xa, 0x4e21, 0x1f, @remote, 0x2000000000000}], 0xdc) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0xfffffffffffffea5) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) r3 = syz_open_dev$midi(&(0x7f00000003c0)='/dev/midi#\x00', 0x8, 0x101400) ioctl$VT_ACTIVATE(r3, 0x5606, 0x1) r4 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') fsetxattr$security_evm(r0, &(0x7f0000000340)='security.evm\x00', &(0x7f0000000400)=@v1={0x2, "92ba174c321a"}, 0x7, 0x3) sendmsg$TIPC_CMD_GET_NODES(r1, &(0x7f0000000300)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x100010}, 0xc, &(0x7f00000002c0)={&(0x7f0000000280)={0x1c, r4, 0x101, 0x70bd2b, 0x25dfdbff, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}}, 0x84) 12:46:49 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:49 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)}], 0x1, 0x0) [ 400.274495][ T1447] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 400.808751][ T1457] binder_alloc: binder_alloc_mmap_handler: 1429 20001000-20004000 already mapped failed -16 [ 400.819119][ T1457] binder_alloc: 1429: binder_alloc_buf, no vma [ 400.825002][ T1456] binder: BINDER_SET_CONTEXT_MGR already set [ 400.826178][ T1457] binder: 1429:1457 transaction failed 29189/-3, size 0-0 line 3147 [ 400.832007][ T1456] binder: 1429:1456 ioctl 40046207 0 returned -16 [ 400.846242][ T1457] binder: 1429:1457 ioctl c0306201 20000400 returned -14 12:46:49 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x6000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:49 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x4000000, {0x8}}, 0x14}}, 0x0) 12:46:49 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, 0x0) pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:49 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:49 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)}], 0x1, 0x0) [ 400.853620][ T7660] binder: release 1429:1430 transaction 278 out, still active [ 400.869802][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 400.875693][ T7660] binder: undelivered TRANSACTION_ERROR: 29189 [ 400.916738][ T7660] binder: send failed reply for transaction 278, target dead 12:46:50 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x8000000, {0x8}}, 0x14}}, 0x0) 12:46:50 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) r4 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r4, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 400.979324][ T1464] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 401.006182][ T1471] binder: 1467:1471 ioctl c0306201 20000400 returned -14 [ 401.020497][ T1472] overlayfs: filesystem on './file0' not supported as upperdir 12:46:50 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f00000003c0)=""/114, 0x72) r2 = syz_open_dev$dspn(&(0x7f0000000280)='/dev/dsp#\x00', 0xfffffffffffff7df, 0x100) recvfrom$inet6(r2, &(0x7f00000002c0)=""/151, 0x97, 0x1, &(0x7f0000000380)={0xa, 0x4e24, 0x90e, @empty, 0x5}, 0x1c) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) r3 = syz_open_dev$mice(&(0x7f0000000100)='/dev/input/mice\x00', 0x0, 0x0) ioctl$CAPI_REGISTER(r3, 0x400c4301, &(0x7f0000000140)={0x5, 0x4, 0x3ff}) socket$pppoe(0x18, 0x1, 0x0) 12:46:50 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:50 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:50 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xa000000, {0x8}}, 0x14}}, 0x0) 12:46:50 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 401.257391][ T1490] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 401.796859][ T1500] binder_alloc: binder_alloc_mmap_handler: 1467 20001000-20004000 already mapped failed -16 [ 401.807113][ T1499] binder: BINDER_SET_CONTEXT_MGR already set [ 401.814234][ T1499] binder: 1467:1499 ioctl 40046207 0 returned -16 [ 401.820972][ T1500] binder_alloc: 1467: binder_alloc_buf, no vma [ 401.827254][ T1500] binder: 1467:1500 transaction failed 29189/-3, size 0-0 line 3147 [ 401.835448][ T1500] binder: 1467:1500 ioctl c0306201 20000400 returned -14 12:46:50 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x6800, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:50 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xe000000, {0x8}}, 0x14}}, 0x0) 12:46:50 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) r4 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r4, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:50 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:50 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 401.842878][ T7660] binder: release 1467:1471 transaction 281 out, still active [ 401.859606][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 401.884624][ T7660] binder: undelivered TRANSACTION_ERROR: 29189 [ 401.885367][ T1505] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 401.893935][ T7660] binder: send failed reply for transaction 281, target dead 12:46:50 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xf000000, {0x8}}, 0x14}}, 0x0) 12:46:51 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, 0x0, 0x0, 0x0) [ 402.004679][ T1515] binder: 1513:1515 ioctl c0306201 20000400 returned -14 12:46:51 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x10000000, {0x8}}, 0x14}}, 0x0) 12:46:51 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:51 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r4, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:51 executing program 2: r0 = userfaultfd(0x0) r1 = open(&(0x7f0000000100)='./file0\x00', 0x400, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000480)={&(0x7f000063c000/0x4000)=nil, &(0x7f0000a9c000/0x3000)=nil, &(0x7f0000022000/0x4000)=nil, &(0x7f000090d000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000774000/0x2000)=nil, &(0x7f0000894000/0x1000)=nil, &(0x7f0000b97000/0x3000)=nil, &(0x7f00006e6000/0x2000)=nil, &(0x7f00007e8000/0x4000)=nil, &(0x7f00008a9000/0x4000)=nil, &(0x7f0000000400)="074e98fbb57c03bfdf6115888d8f09be277e6221ad26ae301c783c1a02cb058fb6aef2427166b43a15d464c969dc19ace99ab5a4fb832026a3d8cd6c89b47f428a44bb93f950337956af8ad3478be805f1657248aa566ab02b89448f8cca64011f4e1e550ce1f2a160249973cc5b2d2c82a4b4708a8f", 0x76, r0}, 0x68) getsockname$packet(0xffffffffffffff9c, &(0x7f0000000500)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000540)=0x14) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000006c0)='TIPCv2\x00') sendmsg$TIPC_NL_LINK_RESET_STATS(r1, &(0x7f00000008c0)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000880)={&(0x7f0000000700)={0x148, r3, 0x804, 0x70bd27, 0x25dfdbff, {}, [@TIPC_NLA_SOCK={0x44, 0x2, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x20}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x9b2}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x53a}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7fff}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x3}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x81b}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}]}, @TIPC_NLA_LINK={0xcc, 0x4, [@TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_WIN={0x8}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x80000001}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x800}]}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0xc, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x54, 0x7, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x23}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x742}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x100000000}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_LINK_NAME={0x14, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xfffffffffffff221}]}]}, @TIPC_NLA_SOCK={0x24, 0x2, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xd444}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xfffffffffffffffd}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}]}]}, 0x148}, 0x1, 0x0, 0x0, 0x4000000}, 0x90) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000580)='/dev/sequencer\x00', 0x0, 0x0) bind$xdp(r4, &(0x7f0000000280)={0x2c, 0x0, r2, 0x39, r4}, 0x5) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r5 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) tee(r4, r5, 0x0, 0x2) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$TCXONC(r1, 0x540a, 0x8) getresuid(&(0x7f0000000340), &(0x7f00000005c0), &(0x7f00000003c0)=0x0) getsockopt$TIPC_CONN_TIMEOUT(r4, 0x10f, 0x82, &(0x7f0000000600), &(0x7f0000000640)=0x4) setuid(r6) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r5, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) ioctl$RTC_SET_TIME(r1, 0x4024700a, &(0x7f0000000380)={0x8, 0x1, 0xe, 0x5, 0x1, 0x172d, 0x2, 0x16b, 0x1}) ioctl$DRM_IOCTL_RES_CTX(r1, 0xc0106426, &(0x7f00000002c0)={0x6, &(0x7f0000000140)=[{}, {}, {}, {}, {0x0}, {}]}) ioctl$SCSI_IOCTL_TEST_UNIT_READY(r1, 0x2) ioctl$DRM_IOCTL_SWITCH_CTX(r1, 0x40086424, &(0x7f0000000300)={r7, 0x1}) 12:46:51 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, 0x0, 0x0, 0x0) [ 402.162375][ T1525] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 402.772325][ T1545] binder_alloc: binder_alloc_mmap_handler: 1513 20001000-20004000 already mapped failed -16 [ 402.782664][ T1545] binder_alloc: 1513: binder_alloc_buf, no vma [ 402.788415][ T1544] binder: BINDER_SET_CONTEXT_MGR already set [ 402.788905][ T1545] binder: 1513:1545 transaction failed 29189/-3, size 0-0 line 3147 [ 402.794948][ T1544] binder: 1513:1544 ioctl 40046207 0 returned -16 [ 402.803349][ T1545] binder: 1513:1545 ioctl c0306201 20000400 returned -14 12:46:51 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x6c00, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:51 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:51 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x60000000, {0x8}}, 0x14}}, 0x0) 12:46:51 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, 0x0, 0x0, 0x0) 12:46:51 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f00001cf000/0xd000)=nil, 0xd000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:51 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r4, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 402.816945][ T7669] binder: release 1513:1515 transaction 284 out, still active [ 402.824464][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 402.830443][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 402.836732][ T7669] binder: send failed reply for transaction 284, target dead 12:46:51 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x9effffff, {0x8}}, 0x14}}, 0x0) 12:46:51 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180), 0x0, 0x0) [ 402.902188][ T1561] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 402.938506][ T1564] binder: 1563:1564 ioctl c0306201 20000400 returned -14 12:46:52 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:52 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xc00e0000, {0x8}}, 0x14}}, 0x0) [ 403.061615][ T1661] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:52 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r4, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:52 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 403.214990][ T1696] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 403.399934][ C1] net_ratelimit: 18 callbacks suppressed [ 403.399941][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 403.411354][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 403.629786][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 403.635586][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 403.639810][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 403.647145][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 403.735398][ T1704] binder_alloc: binder_alloc_mmap_handler: 1563 20001000-20004000 already mapped failed -16 [ 403.745837][ T1704] binder_alloc: 1563: binder_alloc_buf, no vma [ 403.746765][ T1703] binder: BINDER_SET_CONTEXT_MGR already set [ 403.752191][ T1704] binder: 1563:1704 transaction failed 29189/-3, size 0-0 line 3147 [ 403.764816][ T1703] binder: 1563:1703 ioctl 40046207 0 returned -16 [ 403.766337][ T1704] binder: 1563:1704 ioctl c0306201 20000400 returned -14 12:46:52 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x7400, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:52 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xef020000, {0x8}}, 0x14}}, 0x0) 12:46:52 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180), 0x0, 0x0) 12:46:52 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:52 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) r5 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r5, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:52 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f0000ffc000/0x3000)=nil, 0x3000}) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(0xffffffffffffffff, 0x84, 0xa, &(0x7f0000000100)={0x80000000, 0x100, 0x42135175386c4f50, 0x7, 0x4, 0x4, 0x380000000000000, 0x2, 0x0}, &(0x7f0000000140)=0x20) setsockopt$inet_sctp_SCTP_PR_SUPPORTED(r1, 0x84, 0x71, &(0x7f0000000280)={r2, 0x88}, 0x8) [ 403.780067][ T7660] binder: release 1563:1564 transaction 287 out, still active [ 403.787551][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 403.793550][ T7660] binder: undelivered TRANSACTION_ERROR: 29189 [ 403.799821][ T7660] binder: send failed reply for transaction 287, target dead [ 403.847629][ T1715] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:52 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xf0ffffff, {0x8}}, 0x14}}, 0x0) 12:46:52 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180), 0x0, 0x0) [ 403.910455][ T1719] binder: 1717:1719 ioctl c0306201 20000400 returned -14 [ 403.932675][ T1720] overlayfs: filesystem on './file0' not supported as upperdir 12:46:53 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r3, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:53 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\xc0', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:53 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xfffff000, {0x8}}, 0x14}}, 0x0) 12:46:53 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{0x0}], 0x1, 0x0) [ 404.189822][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 404.195668][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 404.429867][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 404.435661][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 404.700907][ T1749] binder_alloc: binder_alloc_mmap_handler: 1717 20001000-20004000 already mapped failed -16 [ 404.711434][ T1749] binder_alloc: 1717: binder_alloc_buf, no vma [ 404.717351][ T1748] binder: BINDER_SET_CONTEXT_MGR already set [ 404.717646][ T1749] binder: 1717:1749 transaction failed 29189/-3, size 0-0 line 3147 [ 404.723878][ T1748] binder: 1717:1748 ioctl 40046207 0 returned -16 [ 404.731905][ T1749] binder: 1717:1749 ioctl c0306201 20000400 returned -14 12:46:53 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x7a00, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:53 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:53 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) r4 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r4, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:53 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xffffff7f, {0x8}}, 0x14}}, 0x0) 12:46:53 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{0x0}], 0x1, 0x0) 12:46:53 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f0000fe9000/0x14000)=nil, 0x14000}) [ 404.745448][ T7669] binder: release 1717:1719 transaction 290 out, still active [ 404.753006][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 404.758905][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 404.765180][ T7669] binder: send failed reply for transaction 290, target dead 12:46:53 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xffffff9e, {0x8}}, 0x14}}, 0x0) [ 404.832603][ T1760] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:53 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{0x0}], 0x1, 0x0) [ 404.889448][ T1764] binder: 1762:1764 ioctl c0306201 20000400 returned -14 12:46:53 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:54 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) r5 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r5, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:54 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xfffffff0, {0x8}}, 0x14}}, 0x0) [ 405.022112][ T1772] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:54 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)}], 0x1, 0x0) [ 405.677818][ T1792] binder_alloc: binder_alloc_mmap_handler: 1762 20001000-20004000 already mapped failed -16 [ 405.688074][ T1791] binder: BINDER_SET_CONTEXT_MGR already set [ 405.694290][ T1791] binder: 1762:1791 ioctl 40046207 0 returned -16 [ 405.694556][ T1792] binder_alloc: 1762: binder_alloc_buf, no vma [ 405.707406][ T1792] binder: 1762:1792 transaction failed 29189/-3, size 0-0 line 3147 [ 405.715910][ T1792] binder: 1762:1792 ioctl c0306201 20000400 returned -14 12:46:54 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x1000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:54 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:54 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x40030000000000, {0x8}}, 0x14}}, 0x0) 12:46:54 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r3, 0x2, &(0x7f0000000400)=""/19) socket$inet(0x2, 0x3, 0x2) r4 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r4, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r4, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r4, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) r5 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r5, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:54 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)}], 0x1, 0x0) 12:46:54 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000280)='/dev/qat_adf_ctl\x00', 0x4000, 0x0) pipe2(&(0x7f0000000100)={0xffffffffffffffff}, 0x800) ioctl$SCSI_IOCTL_PROBE_HOST(r2, 0x5385, &(0x7f0000000140)={0x34, ""/52}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 405.723341][ T7660] binder: release 1762:1764 transaction 293 out, still active [ 405.737508][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 405.743526][ T7660] binder: undelivered TRANSACTION_ERROR: 29189 [ 405.790042][ T7660] binder: send failed reply for transaction 293, target dead [ 405.815140][ T1802] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:54 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xf0ffffffffffff, {0x8}}, 0x14}}, 0x0) [ 405.835328][ T1808] binder: 1806:1808 ioctl c0306201 20000400 returned -14 12:46:54 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)}], 0x1, 0x0) 12:46:54 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:55 executing program 2: r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_ifreq(r0, 0x8939, &(0x7f0000000100)={'syz_tun\x00', @ifru_map={0x5, 0x7, 0x6, 0x2, 0x1, 0x1}}) r1 = syz_open_dev$mice(&(0x7f0000000140)='/dev/input/mice\x00', 0x0, 0x2a800) ioctl$UI_GET_VERSION(r1, 0x8004552d, &(0x7f0000000280)) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) r3 = request_key(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x0}, &(0x7f0000000340)='\\/vboxnet0\x82/wlan0\x00', 0xffffffffffffffff) keyctl$setperm(0x5, r3, 0x0) r4 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r2, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r4, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r2, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:55 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000400)=""/19) r5 = socket$inet(0x2, 0x3, 0x2) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r6, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r6, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r7, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r7, 0x28, 0x0, &(0x7f0000000100)=0x4, 0xfffffffffffffdf5) setsockopt$inet_int(r5, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) dup2(r3, r3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000240)) pwritev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:55 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 405.989648][ T1820] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 406.145509][ T1831] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 406.633386][ T1839] binder_alloc: binder_alloc_mmap_handler: 1806 20001000-20004000 already mapped failed -16 [ 406.643653][ T1838] binder: BINDER_SET_CONTEXT_MGR already set [ 406.649665][ T1838] binder: 1806:1838 ioctl 40046207 0 returned -16 [ 406.649846][ T1839] binder_alloc: 1806: binder_alloc_buf, no vma [ 406.662439][ T1839] binder: 1806:1839 transaction failed 29189/-3, size 0-0 line 3147 [ 406.670636][ T1839] binder: 1806:1839 ioctl c0306201 20000400 returned -14 12:46:55 executing program 3 (fault-call:3 fault-nth:0): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:55 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x100000000000000, {0x8}}, 0x14}}, 0x0) 12:46:55 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:55 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x2000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:55 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r0, &(0x7f0000465f8e)=""/114, 0xfffffffffffffc8a) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:55 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000400)=""/19) r5 = socket$inet(0x2, 0x3, 0x2) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r6, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r6, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r7, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r7, 0x28, 0x0, &(0x7f0000000100)=0x4, 0xfffffffffffffdf5) setsockopt$inet_int(r5, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) dup2(r3, r3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000240)) pwritev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 406.677935][ T7669] binder: release 1806:1808 transaction 296 out, still active [ 406.685538][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 406.691486][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 406.697739][ T7669] binder: send failed reply for transaction 296, target dead [ 406.746418][ T1845] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:55 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x200000000000000, {0x8}}, 0x14}}, 0x0) [ 406.792460][ T1852] binder: 1851:1852 ioctl c0306201 20000400 returned -14 12:46:55 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:55 executing program 4: perf_event_open(&(0x7f000025c000)={0x1, 0x70, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, 0x0, 0xffffffffffffff10, 0xfffffffffffffff9, 0x0, 0xffac) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000700)='/dev/net/tun\x00', 0xfffbfffffffffffe, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'\x00', 0x43732e5398416f1a}) r2 = socket$inet6_sctp(0xa, 0x10000000005, 0x84) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r2, 0x84, 0xf, &(0x7f0000000b80)=ANY=[@ANYBLOB="740000ea64e5010827be0153b56f86ffce7d7b21e27d7fcb9a487529bde2575c40cc8516a7f358f6c486f3a3524985dcd385e6e2e0531b000002ed900f98565c913028f37e3d2abec7172211c552cdb639cd18cf6a8f27deea3cafb725db3e4a87737b834edd15f97c4c01cfc559c2a8952aeeab4b18641a16ceaf858938f39b9c5c0900000000000000ca5b66506b73b7c7054039be4d8dc3885c94fe432be90000000000000000ef000000000000000000000000000000000000000ea62bd480f59d614367c6f2fdf99bebe768db6610cdbe9066c799f3cb47d2a22000000000000000000000000000000073abedfe47d15ffae0f97271a93b7270d958d237ec4d3c4db2e10a185ce0c2b78353ab76797ab8f96d9c9a567c8aafc51ffe2ee1f74e26ef4a4a2c0a366f21d53d1d82913d8ba8795ac3bbc8b6fc36649175b6ed4c2b5880dda313f3f1e8a5"], 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={&(0x7f0000abe000)}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r4 = shmget$private(0x0, 0x1000, 0xfffffffffffffffe, &(0x7f0000ffa000/0x1000)=nil) shmctl$IPC_STAT(r4, 0x2, &(0x7f0000000400)=""/19) r5 = socket$inet(0x2, 0x3, 0x2) r6 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000580)='/dev/snapshot\x00', 0x2, 0x0) ioctl$KVM_SET_TSC_KHZ(r6, 0xaea2, 0x2) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000000, 0x43130, 0xffffffffffffffff, 0x0) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r6, 0x84, 0x1e, &(0x7f0000000500)=0x1fe, 0x2) r7 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x20100, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r6, 0x10e, 0x3, &(0x7f0000000440)=0x5, 0x4) getsockname(r7, &(0x7f0000000140)=@ipx, &(0x7f00000001c0)=0xfffffffffffffffa) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r7, 0x28, 0x0, &(0x7f0000000100)=0x4, 0xfffffffffffffdf5) setsockopt$inet_int(r5, 0x0, 0xca, &(0x7f0000000000)=0x10001, 0x10) dup2(r3, r3) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x3e7, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0, 0xffffffffffffffff, 0x0) ioctl$BLKGETSIZE64(0xffffffffffffffff, 0x80081272, &(0x7f0000000240)) pwritev(0xffffffffffffffff, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 406.852848][ T1856] binder_alloc: binder_alloc_mmap_handler: 1851 20001000-20004000 already mapped failed -16 12:46:55 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 406.934274][ T1856] binder_alloc: 1851: binder_alloc_buf, no vma [ 406.985593][ T7660] binder: release 1851:1852 transaction 299 out, still active [ 406.995234][ T1856] binder: 1851:1856 transaction failed 29189/-3, size 0-0 line 3147 [ 407.003046][ T1869] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 407.009363][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 407.020174][ T1856] binder: 1851:1856 ioctl c0306201 20000400 returned -14 12:46:56 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x400000000000000, {0x8}}, 0x14}}, 0x0) [ 407.031549][ T7660] binder: undelivered TRANSACTION_ERROR: 29189 12:46:56 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:56 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x3000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 407.058702][ T7660] binder: send failed reply for transaction 299, target dead 12:46:56 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='+', 0x1}], 0x1, 0x0) 12:46:56 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x800000000000000, {0x8}}, 0x14}}, 0x0) 12:46:56 executing program 4 (fault-call:3 fault-nth:0): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 407.187599][ T1877] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 407.201318][ T1879] binder: 1878:1879 ioctl c0306201 20000400 returned -14 12:46:56 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 407.386388][ T1895] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:56 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) r2 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/qat_adf_ctl\x00', 0x2, 0x0) ioctl$BLKSECDISCARD(r2, 0x127d, &(0x7f0000000140)=0x2) 12:46:56 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xa00000000000000, {0x8}}, 0x14}}, 0x0) 12:46:56 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:46:56 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='-', 0x1}], 0x1, 0x0) 12:46:56 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 407.572179][ T1902] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:56 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xe00000000000000, {0x8}}, 0x14}}, 0x0) 12:46:56 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 407.745933][ T1913] QAT: Invalid ioctl [ 407.758986][ T1922] QAT: Invalid ioctl [ 407.766576][ T1923] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 407.967800][ T1929] binder_alloc: binder_alloc_mmap_handler: 1878 20001000-20004000 already mapped failed -16 [ 407.978165][ T1928] binder: BINDER_SET_CONTEXT_MGR already set [ 407.985227][ T1928] binder: 1878:1928 ioctl 40046207 0 returned -16 [ 407.990395][ T1929] binder_alloc: 1878: binder_alloc_buf, no vma [ 407.997908][ T1929] binder: 1878:1929 transaction failed 29189/-3, size 0-0 line 3147 [ 408.006846][ T1929] binder: 1878:1929 ioctl c0306201 20000400 returned -14 12:46:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x4000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:57 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x2}], 0x1, 0x0) 12:46:57 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xf00000000000000, {0x8}}, 0x14}}, 0x0) 12:46:57 executing program 2: r0 = userfaultfd(0x100000000000) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:57 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='+', 0x1}], 0x1, 0x0) 12:46:57 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 408.014194][ T7660] binder: release 1878:1879 transaction 302 out, still active [ 408.029757][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 408.035681][ T7660] binder: undelivered TRANSACTION_ERROR: 29189 [ 408.089924][ T7660] binder: send failed reply for transaction 302, target dead 12:46:57 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x1000000000000000, {0x8}}, 0x14}}, 0x0) [ 408.131929][ T1938] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 408.148751][ T1966] binder: 1939:1966 ioctl c0306201 20000400 returned -14 12:46:57 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x3}], 0x1, 0x0) [ 408.186727][ T1938] overlayfs: filesystem on './file0' not supported as upperdir [ 408.195844][ T2022] binder_alloc: binder_alloc_mmap_handler: 1939 20001000-20004000 already mapped failed -16 12:46:57 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:57 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0x19) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:57 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='-', 0x1}], 0x1, 0x0) [ 408.256269][ T1966] binder: BINDER_SET_CONTEXT_MGR already set [ 408.300854][ T1966] binder: 1939:1966 ioctl 40046207 0 returned -16 [ 408.349172][ T7660] binder: release 1939:1966 transaction 305 out, still active [ 408.371295][ T7660] binder: undelivered TRANSACTION_COMPLETE 12:46:57 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x6000000000000000, {0x8}}, 0x14}}, 0x0) 12:46:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x5000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 408.399989][ T7660] binder: send failed reply for transaction 305, target dead [ 408.418846][ T2087] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:57 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x4}], 0x1, 0x0) 12:46:57 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:57 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000100)='/dev/rtc0\x00', 0x200000, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffff9c, 0x84, 0x73, &(0x7f0000000140)={0x0, 0x80000000, 0x10, 0xdd, 0x4}, &(0x7f0000000280)=0x18) setsockopt$inet_sctp6_SCTP_CONTEXT(r2, 0x84, 0x11, &(0x7f00000002c0)={r3, 0x3f}, 0x8) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:57 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x2}], 0x1, 0x0) 12:46:57 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x9effffff00000000, {0x8}}, 0x14}}, 0x0) [ 408.589866][ C0] net_ratelimit: 21 callbacks suppressed [ 408.589873][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 408.601374][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 408.604142][ T2176] binder: 2175:2176 ioctl c0306201 20000400 returned -14 [ 408.653370][ T2180] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 408.683260][ T2188] binder_alloc: binder_alloc_mmap_handler: 2175 20001000-20004000 already mapped failed -16 12:46:57 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xc00e000000000000, {0x8}}, 0x14}}, 0x0) 12:46:57 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x8}], 0x1, 0x0) 12:46:57 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 408.723330][ T2176] binder: BINDER_SET_CONTEXT_MGR already set [ 408.749617][ T2176] binder: 2175:2176 ioctl 40046207 0 returned -16 12:46:57 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000380)={{&(0x7f0000340000/0x1000)=nil, 0x1000}, 0x2}) r2 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vga_arbiter\x00', 0x2, 0x0) accept$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0}, &(0x7f0000000280)=0x14) setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f00000002c0)={@dev={0xac, 0x14, 0x14, 0x14}, @remote, r3}, 0xc) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f0000000300)={0x3, [0x3, 0x101, 0xf2]}, &(0x7f0000000340)=0xa) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) ioctl$KVM_SET_GUEST_DEBUG(r2, 0x4048ae9b, &(0x7f00000003c0)={0x20002, 0x0, [0x7, 0x524, 0x6, 0x0, 0x4, 0x3ff, 0x7, 0xe7]}) [ 408.793072][ T7660] binder: release 2175:2176 transaction 307 out, still active [ 408.801637][ T2188] binder_alloc: 2175: binder_alloc_buf, no vma [ 408.812773][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 408.835386][ T7660] binder: send failed reply for transaction 307, target dead [ 408.856119][ T2188] binder: 2175:2188 transaction failed 29189/-3, size 0-0 line 3147 12:46:57 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x3}], 0x1, 0x0) 12:46:57 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x6000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 408.911008][ T2188] binder: 2175:2188 ioctl c0306201 20000400 returned -14 [ 408.950447][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 12:46:58 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x500}], 0x1, 0x0) 12:46:58 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xef02000000000000, {0x8}}, 0x14}}, 0x0) [ 409.007432][ T2307] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 409.035121][ T2313] binder: 2312:2313 ioctl c0306201 20000400 returned -14 12:46:58 executing program 2: r0 = userfaultfd(0xfffffffffffffffd) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r1, &(0x7f0000000180)=""/223, 0x8e) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000100)={0xaa, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) r2 = syz_open_dev$amidi(&(0x7f0000000140)='/dev/amidi#\x00', 0xaa, 0x80000) ioctl$VIDIOC_ENUM_DV_TIMINGS(r2, 0xc0945662, &(0x7f0000000400)={0xfffffffffffffed5, 0x0, [], {0x0, @reserved}}) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0x7, &(0x7f0000000340)={0x0, 0xffffffff, 0xf59a, 0x7}, 0x10) write$P9_RLCREATE(r2, &(0x7f0000000280)={0x18, 0xf, 0x2, {{0x2, 0x1, 0x7}, 0x5}}, 0x18) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000002c0)=0x4) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) close(r0) ioctl$UFFDIO_UNREGISTER(r2, 0x8010aa01, &(0x7f0000000300)={&(0x7f000053b000/0x1000)=nil, 0x1000}) pause() prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) getsockopt$inet6_buf(r2, 0x29, 0x6, &(0x7f0000000380), &(0x7f00000003c0)) [ 409.069793][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 409.075614][ C1] protocol 88fb is buggy, dev hsr_slave_1 12:46:58 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:58 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xf0ffffff00000000, {0x8}}, 0x14}}, 0x0) 12:46:58 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x4}], 0x1, 0x0) 12:46:58 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x20000081}], 0x1, 0x0) 12:46:58 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xffffff7f00000000, {0x8}}, 0x14}}, 0x0) [ 409.324381][ T2431] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:58 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:58 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0xfffffffffffff000, {0x8}}, 0x14}}, 0x0) 12:46:58 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x8}], 0x1, 0x0) [ 409.516573][ T2558] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 409.629841][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 409.635650][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 409.815688][ T2674] binder_alloc: binder_alloc_mmap_handler: 2312 20001000-20004000 already mapped failed -16 [ 409.826032][ T2673] binder: BINDER_SET_CONTEXT_MGR already set [ 409.833593][ T2673] binder: 2312:2673 ioctl 40046207 0 returned -16 [ 409.839838][ T2674] binder_alloc: 2312: binder_alloc_buf, no vma [ 409.846257][ T2674] binder: 2312:2674 transaction failed 29189/-3, size 0-0 line 3147 [ 409.858390][ T2674] binder: 2312:2674 ioctl c0306201 20000400 returned -14 12:46:58 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x7000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:58 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x7ffff000}], 0x1, 0x0) 12:46:58 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x2}}, 0x14}}, 0x0) [ 409.865765][ T7669] binder: release 2312:2313 transaction 310 out, still active [ 409.873332][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 409.873374][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 409.879779][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 409.885809][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 409.890759][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 409.902464][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 409.908693][ T7669] binder: send failed reply for transaction 310, target dead 12:46:59 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x500}], 0x1, 0x0) 12:46:59 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:59 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x3}}, 0x14}}, 0x0) 12:46:59 executing program 2: r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video2\x00', 0x2, 0x0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) ppoll(&(0x7f0000000280)=[{r0, 0x2}, {r2, 0x20}], 0x2, &(0x7f00000002c0)={0x0, 0x1c9c380}, &(0x7f0000000300)={0x7}, 0x8) r3 = userfaultfd(0x0) ioctl$VIDIOC_PREPARE_BUF(r0, 0xc058565d, &(0x7f0000000540)={0x0, 0x0, 0x4, 0x4, {0x77359400}, {0x1, 0x0, 0xff, 0x5, 0x1, 0x9, "9bcf68f8"}, 0xaf24, 0x4, @planes=&(0x7f0000000500)={0x3f, 0x10001, @mem_offset=0x856}, 0x4}) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)) r4 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) syz_open_dev$vivid(&(0x7f00000004c0)='/dev/video#\x00', 0x0, 0x2) openat$fuse(0xffffffffffffff9c, &(0x7f0000000480)='/dev/fuse\x00', 0x2, 0x0) read(r3, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r4, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r3, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000340)='/dev/sequencer\x00', 0x80240, 0x0) ioctl$sock_inet_SIOCSARP(r5, 0x8955, &(0x7f0000000380)={{0x2, 0x4e24, @local}, {0x6, @local}, 0x2, {0x2, 0x4e24, @multicast2}, 'batadv0\x00'}) getsockopt$IP_VS_SO_GET_INFO(r1, 0x0, 0x481, &(0x7f0000000400), &(0x7f0000000440)=0xc) [ 410.009041][ T2683] binder: 2682:2683 ioctl c0306201 20000400 returned -14 12:46:59 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x2, 0x0) [ 410.104025][ T2695] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:46:59 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x4}}, 0x14}}, 0x0) 12:46:59 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:59 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x3, 0x0) 12:46:59 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x20000081}], 0x1, 0x0) [ 410.386186][ T2820] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 410.785236][ T2929] binder_alloc: binder_alloc_mmap_handler: 2682 20001000-20004000 already mapped failed -16 [ 410.795499][ T2928] binder: BINDER_SET_CONTEXT_MGR already set [ 410.802319][ T2928] binder: 2682:2928 ioctl 40046207 0 returned -16 [ 410.802384][ T2929] binder_alloc: 2682: binder_alloc_buf, no vma [ 410.815104][ T2929] binder: 2682:2929 transaction failed 29189/-3, size 0-0 line 3147 [ 410.823637][ T2929] binder: 2682:2929 ioctl c0306201 20000400 returned -14 12:46:59 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x20000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:46:59 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x5}}, 0x14}}, 0x0) 12:46:59 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000040)='/dev/null\x00', 0x400000, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000100)=0x1a) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000280)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) setsockopt$sock_linger(r1, 0x1, 0xd, &(0x7f0000000140)={0x1, 0x97}, 0x8) read(r2, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r1, 0x8010aa01, &(0x7f00000002c0)={&(0x7f00004ab000/0x2000)=nil, 0x2000}) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:46:59 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x4, 0x0) 12:46:59 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:46:59 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x7ffff000}], 0x1, 0x0) [ 410.830983][ T7669] binder: release 2682:2683 transaction 313 out, still active [ 410.838476][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 410.844442][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 410.855314][ T7669] binder: send failed reply for transaction 313, target dead 12:47:00 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x6}}, 0x14}}, 0x0) [ 410.942291][ T2943] binder: 2940:2943 ioctl c0306201 20000400 returned -14 [ 410.948053][ T2939] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:47:00 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x8, 0x0) [ 411.006252][ T3009] overlayfs: filesystem on './file0' not supported as upperdir 12:47:00 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0xfffffffffffffdee) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) ioctl$KVM_REINJECT_CONTROL(r0, 0xae71, &(0x7f0000000100)={0x55e6}) 12:47:00 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:00 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x2, 0x0) 12:47:00 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x7}}, 0x14}}, 0x0) [ 411.238890][ T3067] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 411.723897][ T3207] binder_alloc: binder_alloc_mmap_handler: 2940 20001000-20004000 already mapped failed -16 [ 411.734564][ T3207] binder: BINDER_SET_CONTEXT_MGR already set [ 411.743940][ T3207] binder: 2940:3207 ioctl 40046207 0 returned -16 [ 411.743985][ T3208] binder_alloc: 2940: binder_alloc_buf, no vma [ 411.756699][ T3208] binder: 2940:3208 transaction failed 29189/-3, size 0-0 line 3147 [ 411.764845][ T3208] binder: 2940:3208 ioctl c0306201 20000400 returned -14 12:47:00 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x3f000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:00 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x500, 0x0) 12:47:00 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x9}}, 0x14}}, 0x0) 12:47:00 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:00 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x3, 0x0) [ 411.772160][ T7669] binder: release 2940:2943 transaction 316 out, still active [ 411.783162][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 411.794748][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 411.829119][ T7669] binder: send failed reply for transaction 316, target dead [ 411.877599][ T3218] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:47:00 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0xc}}, 0x14}}, 0x0) 12:47:00 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x20000081, 0x0) [ 411.925861][ T3273] binder: 3234:3273 ioctl c0306201 20000400 returned -14 12:47:01 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:01 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000280)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:47:01 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x10}}, 0x14}}, 0x0) 12:47:01 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x4, 0x0) 12:47:01 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x7ffff000, 0x0) [ 412.151408][ T3366] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 412.720884][ T3485] binder_alloc: binder_alloc_mmap_handler: 3234 20001000-20004000 already mapped failed -16 [ 412.731260][ T3485] binder: BINDER_SET_CONTEXT_MGR already set [ 412.737326][ T3485] binder: 3234:3485 ioctl 40046207 0 returned -16 [ 412.737378][ T3487] binder_alloc: 3234: binder_alloc_buf, no vma [ 412.750428][ T3487] binder: 3234:3487 transaction failed 29189/-3, size 0-0 line 3147 [ 412.758456][ T3487] binder: 3234:3487 ioctl c0306201 20000400 returned -14 12:47:01 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x48000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:01 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000170000/0x4000)=nil, 0x4000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:47:01 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:01 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0xe6c}}, 0x14}}, 0x0) 12:47:01 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x8) 12:47:01 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x8, 0x0) [ 412.765898][ T7669] binder: release 3234:3273 transaction 319 out, still active [ 412.779758][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 412.785743][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 412.792083][ T7669] binder: send failed reply for transaction 319, target dead 12:47:01 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0xe74}}, 0x14}}, 0x0) [ 412.860803][ T3491] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 412.880855][ T3501] binder: 3499:3501 ioctl c0306201 20000400 returned -14 12:47:01 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:02 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xa) 12:47:02 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0xe7c}}, 0x14}}, 0x0) 12:47:02 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x500, 0x0) [ 413.074518][ T3614] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:47:02 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 413.240941][ T3666] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 413.670479][ T3742] binder_alloc: binder_alloc_mmap_handler: 3499 20001000-20004000 already mapped failed -16 [ 413.680841][ T3742] binder: BINDER_SET_CONTEXT_MGR already set [ 413.686902][ T3742] binder: 3499:3742 ioctl 40046207 0 returned -16 [ 413.687347][ T3743] binder_alloc: 3499: binder_alloc_buf, no vma [ 413.703536][ T3743] binder: 3499:3743 transaction failed 29189/-3, size 0-0 line 3147 [ 413.711660][ T3743] binder: 3499:3743 ioctl c0306201 20000400 returned -14 12:47:02 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x4c000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:02 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0xe84}}, 0x14}}, 0x0) 12:47:02 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x10) 12:47:02 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:02 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x20000081, 0x0) 12:47:02 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000280)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 413.718945][ T7669] binder: release 3499:3501 transaction 322 out, still active [ 413.726550][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 413.738990][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 413.745291][ T7669] binder: send failed reply for transaction 322, target dead [ 413.789827][ C1] net_ratelimit: 17 callbacks suppressed [ 413.789834][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 413.793145][ T3749] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 413.795533][ C1] protocol 88fb is buggy, dev hsr_slave_1 12:47:02 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0xe8c}}, 0x14}}, 0x0) 12:47:02 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 413.890182][ T3789] binder: 3772:3789 ioctl c0306201 20000400 returned -14 12:47:02 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xa00) 12:47:03 executing program 2: r0 = userfaultfd(0x0) r1 = syz_open_dev$cec(&(0x7f0000000100)='/dev/cec#\x00', 0x0, 0x2) stat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) r3 = getgid() write$FUSE_ENTRY(r1, &(0x7f0000000340)={0x90, 0x0, 0x7, {0x2, 0x1, 0xcc1, 0x1, 0x7, 0x0, {0x4, 0x17, 0x5, 0x8, 0x100, 0x4, 0xc58, 0x0, 0x1, 0x4, 0x7, r2, r3, 0x100000000, 0x2}}}, 0x90) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r1, 0xc0405519, &(0x7f0000000140)={0x8, 0x6, 0x4cc2, 0x3ff, '\x00', 0x2}) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r4 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r4, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) getrandom(&(0x7f0000000400)=""/174, 0xae, 0x1) 12:47:03 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0xe94}}, 0x14}}, 0x0) [ 414.029402][ T3869] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 414.029805][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 414.039090][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 414.044760][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 414.050512][ C1] protocol 88fb is buggy, dev hsr_slave_1 12:47:03 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x7ffff000, 0x0) [ 414.589912][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 414.595738][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 414.663626][ T3991] binder_alloc: binder_alloc_mmap_handler: 3772 20001000-20004000 already mapped failed -16 [ 414.674010][ T3991] binder: BINDER_SET_CONTEXT_MGR already set [ 414.680166][ T3991] binder: 3772:3991 ioctl 40046207 0 returned -16 [ 414.680436][ T3992] binder_alloc: 3772: binder_alloc_buf, no vma [ 414.692902][ T3992] binder: 3772:3992 transaction failed 29189/-3, size 0-0 line 3147 [ 414.700980][ T3992] binder: 3772:3992 ioctl c0306201 20000400 returned -14 12:47:03 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x60000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:03 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:03 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x4000) 12:47:03 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0xe9c}}, 0x14}}, 0x0) 12:47:03 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x8) 12:47:03 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) socket$inet6(0xa, 0x6, 0x324) read(r1, &(0x7f0000000280)=""/223, 0xfe38) ioctl$UFFDIO_ZEROPAGE(r0, 0xc020aa04, &(0x7f0000000100)={{&(0x7f0000ffa000/0x4000)=nil, 0x4000}}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 414.708707][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 [ 414.716295][ T3486] binder: send failed reply for transaction 325 to 3772:3789 [ 414.780872][ T3486] binder: undelivered TRANSACTION_COMPLETE [ 414.799495][ T4002] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 414.816380][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 12:47:03 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0xea4}}, 0x14}}, 0x0) 12:47:03 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x7400) [ 414.829787][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 414.835625][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 414.861683][ T4018] binder: 4006:4018 ioctl c0306201 20000400 returned -14 12:47:03 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\xff', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:04 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0xeac}}, 0x14}}, 0x0) 12:47:04 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xa) 12:47:04 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x2}}, 0x14}}, 0x0) [ 415.652626][ T4239] binder_alloc: binder_alloc_mmap_handler: 4006 20001000-20004000 already mapped failed -16 [ 415.662908][ T4238] binder: BINDER_SET_CONTEXT_MGR already set [ 415.668960][ T4238] binder: 4006:4238 ioctl 40046207 0 returned -16 [ 415.669042][ T4239] binder_alloc: 4006: binder_alloc_buf, no vma [ 415.681757][ T4239] binder: 4006:4239 transaction failed 29189/-3, size 0-0 line 3147 [ 415.689836][ T4239] binder: 4006:4239 ioctl c0306201 20000400 returned -14 12:47:04 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x68000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:04 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x9400) 12:47:04 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:04 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x4}}, 0x14}}, 0x0) 12:47:04 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x10) 12:47:04 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x2}) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) r2 = syz_open_dev$audion(&(0x7f00000000c0)='/dev/audio#\x00', 0x3, 0x4000) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000100)={r2, &(0x7f0000000280)="3e577c1ac29a54435260f95eb3ec953879bc56c7f89a4e8722854cdd6073e3b75b89a0c7a91c7ef7370d2425577cf07a0ef5da4d8bc02035617dbafb511a101592ee9d677cdfa8e2b790ca3f1022617a9ab6321f896a4fc0aed833d17a6933edefb6810081a702ccb520e51de0f7da24a5372589a55e60a39d8b943be2d8c78032c48dbb4e50e85480e5adaa450e6d6f4eb26fb54821ccbcb4dbeb94f5dff293d5aa83d07650dc36f37fbb5e91e8769ec91d400e53a0554fc81eae965876b2ccf738929a725b4cbbf5a2a9dab5d248172fd110a0df9c66860319b37db8114169df", &(0x7f0000000380)=""/141}, 0x18) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 415.697081][ T7669] binder: release 4006:4018 transaction 328 out, still active [ 415.704765][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 415.716439][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 415.722786][ T7669] binder: send failed reply for transaction 328, target dead 12:47:04 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x8}}, 0x14}}, 0x0) [ 415.796582][ T4242] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 415.816196][ T4254] binder: 4251:4254 ioctl c0306201 20000400 returned -14 [ 415.842516][ T4242] overlayfs: filesystem on './file0' not supported as upperdir 12:47:04 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xa}}, 0x14}}, 0x0) 12:47:04 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\xff', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:05 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xfee00) 12:47:05 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) getsockopt$sock_cred(0xffffffffffffff9c, 0x1, 0x11, &(0x7f0000000140)={0x0}, &(0x7f0000000280)=0xc) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r2, 0x10, &(0x7f00000002c0)={0x400}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000100)='/dev/video37\x00', 0x2, 0x0) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:47:05 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xa00) [ 416.615116][ T4486] binder_alloc: binder_alloc_mmap_handler: 4251 20001000-20004000 already mapped failed -16 [ 416.625495][ T4486] binder_alloc: 4251: binder_alloc_buf, no vma [ 416.631325][ T4485] binder: BINDER_SET_CONTEXT_MGR already set [ 416.632245][ T4486] binder: 4251:4486 transaction failed 29189/-3, size 0-0 line 3147 [ 416.637769][ T4485] binder: 4251:4485 ioctl 40046207 0 returned -16 [ 416.646145][ T4486] binder: 4251:4486 ioctl c0306201 20000400 returned -14 12:47:05 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x6c000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:05 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xe}}, 0x14}}, 0x0) 12:47:05 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:05 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x307100) 12:47:05 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000280)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) r2 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000140)='/dev/vsock\x00', 0x600400, 0x0) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000840)={0x7, 0x0, [{0x5000, 0xac, &(0x7f00000002c0)=""/172}, {0x13000, 0x92, &(0x7f0000000380)=""/146}, {0x1, 0xf3, &(0x7f0000000440)=""/243}, {0x1, 0xbe, &(0x7f0000000540)=""/190}, {0x5000, 0x82, &(0x7f0000000600)=""/130}, {0xf002, 0x79, &(0x7f00000006c0)=""/121}, {0xd002, 0xff, &(0x7f0000000740)=""/255}]}) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) fcntl$setlease(r1, 0x400, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/sequencer2\x00', 0x400, 0x0) ioctl$KDGKBSENT(r3, 0x4b48, &(0x7f0000000100)={0x0, 0x2, 0x9}) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r0) 12:47:05 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x4000) [ 416.659643][ T3486] binder: release 4251:4254 transaction 331 out, still active [ 416.667204][ T3486] binder: undelivered TRANSACTION_COMPLETE 12:47:05 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xf}}, 0x14}}, 0x0) [ 416.717826][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 [ 416.738728][ T3486] binder: send failed reply for transaction 331, target dead [ 416.743131][ T4488] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 416.799166][ T4516] binder: 4501:4516 ioctl c0306201 20000400 returned -14 12:47:05 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\xff', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:05 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x400000) [ 416.858821][ T4573] binder_alloc: binder_alloc_mmap_handler: 4501 20001000-20004000 already mapped failed -16 12:47:05 executing program 2: r0 = userfaultfd(0x800000000004) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:47:05 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x10}}, 0x14}}, 0x0) [ 416.928443][ T4516] binder_alloc: 4501: binder_alloc_buf, no vma [ 416.993557][ T3486] binder: release 4501:4516 transaction 334 out, still active [ 417.000164][ T4516] binder: 4501:4516 transaction failed 29189/-3, size 0-0 line 3147 [ 417.020031][ T3486] binder: undelivered TRANSACTION_COMPLETE 12:47:06 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x7400) [ 417.045789][ T3486] binder: send failed reply for transaction 334, target dead [ 417.051640][ T4516] binder: 4501:4516 ioctl c0306201 20000400 returned -14 [ 417.119634][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 12:47:06 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x74000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:06 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x800000000}) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) mbind(&(0x7f0000358000/0x1000)=nil, 0x1000, 0x0, &(0x7f0000000100)=0x9, 0x3, 0x0) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) ppoll(&(0x7f0000000140)=[{r1, 0x4}, {r1, 0x8000}, {r0, 0x2008}, {r1, 0xa020}], 0x4, &(0x7f0000000280), &(0x7f00000002c0)={0x3}, 0x8) 12:47:06 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\xff', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:06 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x60}}, 0x14}}, 0x0) 12:47:06 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x50a000) 12:47:06 executing program 2: r0 = userfaultfd(0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) getpeername(r1, 0x0, 0x0) r2 = perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) mremap(&(0x7f00007c0000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000054000/0x2000)=nil) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x5c831, 0xffffffffffffffff, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000000)='/dev/dri/card#\x00', 0x0, 0x0) ioctl(r5, 0x0, 0x0) ioctl$KVM_SET_CPUID2(0xffffffffffffffff, 0x4008ae90, 0x0) fsetxattr$security_smack_transmute(r0, &(0x7f0000000280)='security.SMACK64TRANSMUTE\x00', &(0x7f00000002c0)='TRUE', 0x4, 0x1) lsetxattr$trusted_overlay_redirect(&(0x7f00000003c0)='./file0\x00', 0x0, 0x0, 0x0, 0x1) openat$sequencer(0xffffffffffffff9c, &(0x7f00000006c0)='/dev/sequencer\x00', 0x20000, 0x0) r6 = dup(r2) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r6, 0xc0145401, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_percpu_sys\x00', 0x0, 0x0) ioctl$UI_SET_LEDBIT(r7, 0x40045569, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) rt_sigsuspend(0x0, 0x0) getresgid(&(0x7f0000000380), &(0x7f0000000400)=0x0, &(0x7f0000000440)) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000000480)={0x0, 0x0}, &(0x7f00000004c0)=0xc) stat(&(0x7f0000000500)='./file0\x00', &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f00000005c0)={0x0, 0x0}, &(0x7f0000000600)=0xc) r12 = getegid() getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000000640)={0x0, 0x0}, &(0x7f0000000680)=0xc) r14 = getegid() write$FUSE_DIRENTPLUS(r7, &(0x7f0000000fc0)=ANY=[@ANYBLOB="c8020000f5ffffff010000000000000003000000000000000200000000000000040000000000000085000000000000000100000000010000030000000000000000000000001a000008000000000000000800000000000000faffffffffffffff8000000000000000ffffffffa70d000002000000040000000e050000", @ANYRES32, @ANYRES32=r8, @ANYBLOB="d2d0000002000000000000000100000000000000080000000000000001000000090000005b000000000000000100000000000000000000000000000004000000000000000104000000000000010000000c00000004000000000000000800000000000000200000000000000000000000000080010300000000000000e303000000000000ffff00000000200007000000010000000040b502035c6c5f4594b9ef957d5f41181b26f159e1b7a2406918b31750786746026b64ffbd53881b4365448c4e821478358d77c91f26c166074b9ab4fbbe762efb3788e06de90943e17dcc64a07f4327de0c92af33257742e8f8fce2762ece6840af512701c6c33f7e9daf11f1222177", @ANYRES32=r9, @ANYRES32=r10, @ANYBLOB="7a080000d4000000000000000500000000000000f9ffffffffffffff15000000050000ec5c1c4eacb0339d6fd5a152c6b6002f70726f632f73656c662f6e65742f70666b65790000000005000000000000000000000000000000ffffffffffffffffffffffff0000000065e300000500000004000000000000005f890000000000008100000000000000010000000000000009000000000000000100000000000000080000000500000004000000000000000500000029106d00f16686473bcbf0643d1aa1774be1c3a6b4db52347debf3ce0243c0ae7e1ccf3399dd528c4be0f64b9641e57fc5c1c91af76b7b23ee3b5d66bdf14b5b0870c109bd2c6a0b03b34e587675d6bab054771c5b0ee53bd93aca13fa7aadad9b283c423d3becb3bdc4c04b59b6b206354fa772b4902945b8c8732d4d12a754c2b3abc22c64b0bc9e44c7f98e314066cef997f85867b6b0416abf213a2328fcbfee46ba0ee17ff5479bd3f536a42d0b66c88e14fe31388aa336ec407118594bd2dcbeab0b5ca39a2e1d4fd68106f536457d70d3b3d38052d738dcc7e0332d5058b96088a06ea72ada2129ccb72c24bbbd11c6596e32e2bc1996d310ef8cf2d85d5d786dd0e4add114ebbef15a9804855e6d93707d76a5881487cafa9168774546808662c32a272c9f94b05b507c51d9091218da98c74d0e69ea050fc563b894c7ece4c28555d58a9e80ac7ea60904a151645ea78729a875f9dd3af23cd02fb4b2e2ac9c127f6d9828", @ANYRES32=r11, @ANYRES32=r12, @ANYBLOB="116600000100000000000000040000000000000006000000000000000a000000fe8200002f6465762f63757365000000000000000500000000000000020000000000000004000000000000000700000000000000ff7f0000030000000000000000000000ffffff7f0000000003000000000000000100000000000000d57400000000000003000000000000000400000009000000e00c00000400000004000000", @ANYRES32=r13, @ANYRES32=r14, @ANYBLOB="ffffff7f070000000000000001000000000000000000ffee0000000022000000feffffff2f23707070312c757365727db1406b657972696e6704766d6e6574306d643573756d000000000000"], 0x2c8) syz_open_procfs(0x0, &(0x7f0000000000)='net/ip6_tables_targets\x00') [ 417.293230][ T4667] binder: 4665:4667 ioctl c0306201 20000400 returned -14 12:47:06 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xf0}}, 0x14}}, 0x0) 12:47:06 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\xff', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:06 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x9400) 12:47:06 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x70a000) 12:47:06 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x2ef}}, 0x14}}, 0x0) 12:47:06 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\xf9', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 418.049992][ T4883] binder_alloc: binder_alloc_mmap_handler: 4665 20001000-20004000 already mapped failed -16 [ 418.060314][ T4882] binder: BINDER_SET_CONTEXT_MGR already set [ 418.066333][ T4882] binder: 4665:4882 ioctl 40046207 0 returned -16 [ 418.066380][ T4883] binder_alloc: 4665: binder_alloc_buf, no vma [ 418.079075][ T4883] binder: 4665:4883 transaction failed 29189/-3, size 0-0 line 3147 [ 418.087122][ T4883] binder: 4665:4883 ioctl c0306201 20000400 returned -14 12:47:07 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x7a000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:07 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x713000) 12:47:07 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xa00}}, 0x14}}, 0x0) 12:47:07 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) write$FUSE_NOTIFY_RETRIEVE(r1, &(0x7f0000000100)={0x30, 0x5, 0x0, {0x0, 0x3, 0x1f, 0x1f}}, 0x30) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:47:07 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xfee00) 12:47:07 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x7f', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 418.094387][ T7669] binder: release 4665:4667 transaction 337 out, still active [ 418.109023][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 418.117331][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 418.155096][ T7669] binder: send failed reply for transaction 337, target dead 12:47:07 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xe00}}, 0x14}}, 0x0) 12:47:07 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x740000) [ 418.261178][ T4921] binder: 4897:4921 ioctl c0306201 20000400 returned -14 12:47:07 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x8c', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:07 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) dup2(r0, r1) 12:47:07 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xec0}}, 0x14}}, 0x0) 12:47:07 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x307100) [ 418.989866][ C0] net_ratelimit: 20 callbacks suppressed [ 418.989874][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 419.001352][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 419.039069][ T5132] binder_alloc: binder_alloc_mmap_handler: 4897 20001000-20004000 already mapped failed -16 [ 419.049435][ T5131] binder: BINDER_SET_CONTEXT_MGR already set [ 419.055748][ T5131] binder: 4897:5131 ioctl 40046207 0 returned -16 [ 419.057506][ T5132] binder_alloc: 4897: binder_alloc_buf, no vma [ 419.068489][ T5132] binder: 4897:5132 transaction failed 29189/-3, size 0-0 line 3147 [ 419.077155][ T5132] binder: 4897:5132 ioctl c0306201 20000400 returned -14 12:47:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0xfdfdffff, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:08 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x940000) 12:47:08 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xf00}}, 0x14}}, 0x0) 12:47:08 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\xf0', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:08 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x400000) 12:47:08 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000000100)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 419.084540][ T3486] binder: release 4897:4921 transaction 340 out, still active [ 419.092090][ T3486] binder: undelivered TRANSACTION_COMPLETE [ 419.097984][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 [ 419.104259][ T3486] binder: send failed reply for transaction 340, target dead 12:47:08 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x6000}}, 0x14}}, 0x0) [ 419.166607][ T5141] binder: 5139:5141 ioctl c0306201 20000400 returned -14 [ 419.226861][ T5168] binder_alloc: binder_alloc_mmap_handler: 5139 20001000-20004000 already mapped failed -16 12:47:08 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xa05000) 12:47:08 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\xf6', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 419.274226][ T5141] binder: BINDER_SET_CONTEXT_MGR already set [ 419.296111][ T5141] binder: 5139:5141 ioctl 40046207 0 returned -16 [ 419.353593][ T5258] binder_alloc: 5139: binder_alloc_buf, no vma 12:47:08 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x50a000) 12:47:08 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xc00e}}, 0x14}}, 0x0) [ 419.397692][ T5258] binder: 5139:5258 transaction failed 29189/-3, size 0-0 line 3147 [ 419.428287][ T5258] binder: 5139:5258 ioctl c0306201 20000400 returned -14 [ 419.447295][ T3486] binder: release 5139:5141 transaction 343 out, still active [ 419.460634][ T3486] binder: undelivered TRANSACTION_COMPLETE [ 419.469802][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 419.475602][ C1] protocol 88fb is buggy, dev hsr_slave_1 12:47:08 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0xfeffffff, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 419.497900][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 [ 419.514081][ T3486] binder: send failed reply for transaction 343, target dead 12:47:08 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xef02}}, 0x14}}, 0x0) 12:47:08 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xa07000) 12:47:08 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\xfe', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 419.584424][ T5304] binder: 5287:5304 ioctl c0306201 20000400 returned -14 12:47:08 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x70a000) 12:47:08 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xf000}}, 0x14}}, 0x0) 12:47:09 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dsp\x00', 0x80, 0x0) syz_open_pts(r1, 0x22100) r2 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r2, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:47:09 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xee0f00) 12:47:09 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:09 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x34000}}, 0x14}}, 0x0) 12:47:09 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x713000) [ 420.029811][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 420.035627][ C1] protocol 88fb is buggy, dev hsr_slave_1 12:47:09 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x400300}}, 0x14}}, 0x0) [ 420.120761][ T5506] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 420.269840][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 420.269869][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 420.275617][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 420.281395][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 420.376448][ T5621] binder_alloc: binder_alloc_mmap_handler: 5287 20001000-20004000 already mapped failed -16 [ 420.386800][ T5620] binder: BINDER_SET_CONTEXT_MGR already set [ 420.392949][ T5620] binder: 5287:5620 ioctl 40046207 0 returned -16 [ 420.393299][ T5621] binder_alloc: 5287: binder_alloc_buf, no vma [ 420.405739][ T5621] binder: 5287:5621 transaction failed 29189/-3, size 0-0 line 3147 [ 420.413847][ T5621] binder: 5287:5621 ioctl c0306201 20000400 returned -14 12:47:09 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0xfffffdfd, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:09 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x8000000) 12:47:09 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x740000) 12:47:09 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:09 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xf0ffff}}, 0x14}}, 0x0) 12:47:09 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000300)={0xaa, 0xfffffffffffffffc}) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) r2 = dup(r0) r3 = syz_open_dev$usbmon(&(0x7f0000000140)='/dev/usbmon#\x00', 0x0, 0x0) perf_event_open$cgroup(&(0x7f0000000280)={0x3, 0x70, 0xbd14, 0x8, 0x79c, 0x4, 0x0, 0x1ff, 0x200, 0x0, 0x5, 0x400, 0x1, 0x7fff, 0x8, 0x0, 0x5, 0x2, 0x3483, 0x1f, 0xf7f7, 0x400000000000000, 0x1, 0x2, 0xffffffffffffff7f, 0x3c, 0xffffffff, 0x5, 0x2, 0x9, 0xffff, 0x3, 0x4f2ac08c, 0x7, 0x4, 0x5, 0x1ff, 0x7, 0x0, 0x10001, 0x7, @perf_bp={&(0x7f0000000100), 0x5}, 0x11420, 0xffffffff, 0x56, 0x5, 0x800, 0x6, 0x935}, r2, 0xa, r3, 0x1) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 420.421155][ T7669] binder: release 5287:5304 transaction 346 out, still active [ 420.428630][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 420.435179][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 420.441544][ T7669] binder: send failed reply for transaction 346, target dead 12:47:09 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x1000000}}, 0x14}}, 0x0) 12:47:09 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 420.565168][ T5632] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 420.581630][ T5666] binder: 5633:5666 ioctl c0306201 20000400 returned -14 12:47:09 executing program 2: r0 = userfaultfd(0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000280)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) syz_open_dev$sndpcmc(&(0x7f00000000c0)='/dev/snd/pcmC#D#c\x00', 0x81, 0x100) 12:47:09 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xa000000) 12:47:09 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000280)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) r2 = openat$vfio(0xffffffffffffff9c, &(0x7f0000000100)='/dev/vfio/vfio\x00', 0x0, 0x0) ioctl$KVM_S390_VCPU_FAULT(r2, 0x4008ae52, &(0x7f0000000140)=0x100) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 420.741263][ T5749] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:47:09 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x940000) [ 421.377920][ T5869] binder_alloc: binder_alloc_mmap_handler: 5633 20001000-20004000 already mapped failed -16 [ 421.388305][ T5869] binder_alloc: 5633: binder_alloc_buf, no vma [ 421.394178][ T5868] binder: BINDER_SET_CONTEXT_MGR already set [ 421.394726][ T5869] binder: 5633:5869 transaction failed 29189/-3, size 0-0 line 3147 [ 421.408527][ T5869] binder: 5633:5869 ioctl c0306201 20000400 returned -14 [ 421.409049][ T5868] binder: 5633:5868 ioctl 40046207 0 returned -16 12:47:10 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0xfffffffe, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:10 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x2000000}}, 0x14}}, 0x0) 12:47:10 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:10 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x10000000) 12:47:10 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) r2 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000100)='/dev/cachefiles\x00', 0x80080, 0x0) ioctl$SCSI_IOCTL_DOORLOCK(r2, 0x5380) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:47:10 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xa05000) [ 421.415784][ T3486] binder: release 5633:5666 transaction 349 out, still active [ 421.429669][ T3486] binder: undelivered TRANSACTION_COMPLETE [ 421.435608][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 [ 421.442027][ T3486] binder: send failed reply for transaction 349, target dead 12:47:10 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x4000000}}, 0x14}}, 0x0) 12:47:10 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 421.531616][ T5882] binder: 5877:5882 ioctl c0306201 20000400 returned -14 [ 421.551238][ T5880] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:47:10 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) r2 = add_key(&(0x7f0000000100)='cifs.spnego\x00', &(0x7f0000000140)={'syz', 0x2}, &(0x7f0000000180)="59949c12ee6efeaad9e572dd0eae02221d08df8bf8802716f46b3aebf424f122c707cabde17ba9326cb83e537bbddd291d0c13178c475b3e17efe85b421d039dd80f8b58e29b584844372b498fdbe2dfed165341a717", 0x56, 0xfffffffffffffff8) keyctl$revoke(0x3, r2) read(r0, &(0x7f0000000280)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:47:10 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x40000000) 12:47:10 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x8000000}}, 0x14}}, 0x0) [ 421.701953][ T5994] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:47:10 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xa07000) [ 422.325494][ T6116] binder_alloc: binder_alloc_mmap_handler: 5877 20001000-20004000 already mapped failed -16 [ 422.335968][ T6116] binder_alloc: 5877: binder_alloc_buf, no vma [ 422.341849][ T6115] binder: BINDER_SET_CONTEXT_MGR already set [ 422.342386][ T6116] binder: 5877:6116 transaction failed 29189/-3, size 0-0 line 3147 [ 422.348393][ T6115] binder: 5877:6115 ioctl 40046207 0 returned -16 [ 422.357395][ T6116] binder: 5877:6116 ioctl c0306201 20000400 returned -14 12:47:11 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xa000000}}, 0x14}}, 0x0) 12:47:11 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x100000000000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:11 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:11 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x9}) read(r1, &(0x7f0000465f8e)=""/114, 0xffffffffffffff00) ioctl$EVIOCGMTSLOTS(r1, 0x8040450a, &(0x7f0000000280)=""/4096) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:47:11 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x400000000000) 12:47:11 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xee0f00) [ 422.370189][ T7669] binder: release 5877:5882 transaction 352 out, still active [ 422.377748][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 422.390478][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 422.429250][ T7669] binder: send failed reply for transaction 352, target dead [ 422.491079][ T6121] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 422.501046][ T6147] binder: 6128:6147 ioctl c0306201 20000400 returned -14 12:47:11 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xe000000}}, 0x14}}, 0x0) 12:47:11 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 422.537368][ T6121] overlayfs: filesystem on './file0' not supported as upperdir 12:47:11 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x740000000000) 12:47:11 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x8000000) 12:47:11 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xf000000}}, 0x14}}, 0x0) [ 422.734543][ T6245] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:47:11 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x7ffc6edf8000) 12:47:11 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 422.939398][ T6358] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 423.294921][ T6367] binder_alloc: binder_alloc_mmap_handler: 6128 20001000-20004000 already mapped failed -16 [ 423.305265][ T6366] binder: BINDER_SET_CONTEXT_MGR already set [ 423.314580][ T6366] binder: 6128:6366 ioctl 40046207 0 returned -16 [ 423.314750][ T6367] binder_alloc: 6128: binder_alloc_buf, no vma [ 423.327329][ T6367] binder: 6128:6367 transaction failed 29189/-3, size 0-0 line 3147 [ 423.335503][ T6367] binder: 6128:6367 ioctl c0306201 20000400 returned -14 12:47:12 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x940000000000) 12:47:12 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x10000000}}, 0x14}}, 0x0) 12:47:12 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xa000000) 12:47:12 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) r2 = accept4$ax25(0xffffffffffffffff, &(0x7f0000000100)={{0x3, @netrom}, [@default, @remote, @default, @default, @default, @default, @null, @netrom]}, &(0x7f0000000280)=0x48, 0x800) recvfrom(r2, &(0x7f00000002c0)=""/27, 0x1b, 0x2140, &(0x7f0000000300)=@nl=@kern={0x10, 0x0, 0x0, 0x80000000}, 0x80) 12:47:12 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x200000000000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:12 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 423.343468][ T3486] binder: release 6128:6147 transaction 355 out, still active [ 423.350973][ T3486] binder: undelivered TRANSACTION_COMPLETE [ 423.356864][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 [ 423.363236][ T3486] binder: send failed reply for transaction 355, target dead [ 423.456923][ T6376] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 423.469044][ T6380] binder: 6377:6380 ioctl c0306201 20000400 returned -14 12:47:12 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x60000000}}, 0x14}}, 0x0) 12:47:12 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x30710000000000) 12:47:12 executing program 2: r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000002c0)='/dev/vga_arbiter\x00', 0x200, 0x0) ioctl$DRM_IOCTL_CONTROL(r0, 0x40086414, &(0x7f0000000300)={0x1, 0x4268}) r1 = creat(&(0x7f0000000280)='./file0\x00', 0x1) r2 = userfaultfd(0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)) openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r2, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000448000/0x1000)=nil, 0x1000}, 0x1}) read(r1, &(0x7f0000000340)=""/114, 0xfffffffffffffff1) ioctl$UFFDIO_UNREGISTER(r2, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000100)='/dev/dlm-control\x00', 0x30000, 0x0) ioctl$SIOCGSTAMP(r3, 0x8906, &(0x7f0000000140)) 12:47:12 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:12 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x9effffff}}, 0x14}}, 0x0) 12:47:12 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x10000000) 12:47:12 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x80df6efc7f0000) [ 423.774352][ T6499] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:47:12 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xc00e0000}}, 0x14}}, 0x0) [ 424.199806][ C1] net_ratelimit: 18 callbacks suppressed [ 424.199813][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 424.211339][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 424.235415][ T6618] binder_alloc: binder_alloc_mmap_handler: 6377 20001000-20004000 already mapped failed -16 [ 424.245750][ T6617] binder: BINDER_SET_CONTEXT_MGR already set [ 424.251876][ T6617] binder: 6377:6617 ioctl 40046207 0 returned -16 [ 424.252197][ T6618] binder_alloc: 6377: binder_alloc_buf, no vma [ 424.258815][ T6618] binder: 6377:6618 transaction failed 29189/-3, size 0-0 line 3147 [ 424.274171][ T6618] binder: 6377:6618 ioctl c0306201 20000400 returned -14 [ 424.281530][ T3486] binder: release 6377:6380 transaction 358 out, still active [ 424.289025][ T3486] binder: undelivered TRANSACTION_COMPLETE 12:47:13 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x300000000000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:13 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:13 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xa0500000000000) 12:47:13 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x40000000) 12:47:13 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xef020000}}, 0x14}}, 0x0) [ 424.295001][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 [ 424.301275][ T3486] binder: send failed reply for transaction 358, target dead [ 424.384417][ T6624] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 424.413250][ T6638] binder: 6626:6638 ioctl c0306201 20000400 returned -14 12:47:13 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) r2 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) ioctl$CAPI_REGISTER(r2, 0x400c4301, &(0x7f0000000140)={0x2000, 0x5, 0x800}) 12:47:13 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xf0ffffff}}, 0x14}}, 0x0) [ 424.429830][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 424.435615][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 424.439814][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 424.447095][ C0] protocol 88fb is buggy, dev hsr_slave_1 12:47:13 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:13 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xa0700000000000) 12:47:13 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x400000000000) 12:47:13 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$int_out(r1, 0x2, &(0x7f0000000100)) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:47:13 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xfffff000}}, 0x14}}, 0x0) [ 424.679500][ T6745] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 424.989840][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 424.995682][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 425.192086][ T6865] binder_alloc: binder_alloc_mmap_handler: 6626 20001000-20004000 already mapped failed -16 [ 425.202428][ T6864] binder: BINDER_SET_CONTEXT_MGR already set [ 425.208436][ T6864] binder: 6626:6864 ioctl 40046207 0 returned -16 [ 425.208476][ T6865] binder_alloc: 6626: binder_alloc_buf, no vma [ 425.221409][ T6865] binder: 6626:6865 transaction failed 29189/-3, size 0-0 line 3147 [ 425.229411][ T6865] binder: 6626:6865 ioctl c0306201 20000400 returned -14 [ 425.236496][ C0] protocol 88fb is buggy, dev hsr_slave_0 12:47:14 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x400000000000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:14 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:14 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xffffff7f}}, 0x14}}, 0x0) 12:47:14 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xee0f0000000000) 12:47:14 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x740000000000) 12:47:14 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) read(r0, &(0x7f0000000180)=""/223, 0xdf) syz_open_dev$sndtimer(&(0x7f0000000100)='/dev/snd/timer\x00', 0x0, 0x10000) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(0xffffffffffffffff, &(0x7f0000465f8e)=""/114, 0x72) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000140)='/dev/snapshot\x00', 0x200002, 0x0) getsockopt$inet_tcp_buf(r1, 0x6, 0x1f, &(0x7f00000004c0), &(0x7f0000000500)) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(0xffffffffffffff9c, 0x84, 0x22, &(0x7f0000000340)={0x80, 0x201, 0x5, 0x10001, 0x0}, &(0x7f0000000380)=0x10) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x1f, &(0x7f00000003c0)={r2, @in={{0x2, 0x4e22, @loopback}}}, &(0x7f0000000480)=0x90) r3 = syz_open_dev$vcsa(&(0x7f0000000040)='/dev/vcsa#\x00', 0x0, 0x100) ioctl$SNDRV_TIMER_IOCTL_STOP(r1, 0x54a1) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r3, 0x84, 0x6e, &(0x7f0000000280)=[@in6={0xa, 0x4e22, 0xe8c, @empty, 0x1}, @in6={0xa, 0x4e24, 0x4, @initdev={0xfe, 0x88, [], 0x1, 0x0}, 0x7}, @in6={0xa, 0x4e22, 0x1ff, @dev={0xfe, 0x80, [], 0x19}, 0x4}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xd}}, @in6={0xa, 0x4e23, 0x6, @local, 0x1}, @in6={0xa, 0x4e22, 0x1f, @remote, 0x5}, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x11}}], 0xac) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 425.236543][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 425.248302][ T3486] binder: release 6626:6638 transaction 361 out, still active [ 425.257299][ T3486] binder: undelivered TRANSACTION_COMPLETE [ 425.279881][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 [ 425.314174][ T3486] binder: send failed reply for transaction 361, target dead [ 425.341119][ T6873] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:47:14 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xffffff9e}}, 0x14}}, 0x0) 12:47:14 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 425.372956][ T6879] binder: 6874:6879 ioctl c0306201 20000400 returned -14 12:47:14 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x800000000000000) 12:47:14 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x7ffe3f39a000) 12:47:14 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xfffffff0}}, 0x14}}, 0x0) [ 425.510021][ T6988] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:47:14 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 425.728431][ T7049] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 426.156778][ T7108] binder_alloc: binder_alloc_mmap_handler: 6874 20001000-20004000 already mapped failed -16 [ 426.168236][ T7108] binder_alloc: 6874: binder_alloc_buf, no vma [ 426.174773][ T7108] binder: 6874:7108 transaction failed 29189/-3, size 0-0 line 3147 [ 426.174966][ T7107] binder: BINDER_SET_CONTEXT_MGR already set [ 426.182948][ T7108] binder: 6874:7108 ioctl c0306201 20000400 returned -14 [ 426.197303][ T7107] binder: 6874:7107 ioctl 40046207 0 returned -16 12:47:15 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x500000000000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:15 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x40030000000000}}, 0x14}}, 0x0) 12:47:15 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xa00000000000000) 12:47:15 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:15 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x940000000000) [ 426.203852][ T3486] binder: release 6874:6879 transaction 364 out, still active [ 426.219989][ T3486] binder: undelivered TRANSACTION_COMPLETE [ 426.225909][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 12:47:15 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000280)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000000180)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 426.296616][ T3486] binder: send failed reply for transaction 364, target dead [ 426.314202][ T7119] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 426.334709][ T7128] binder: 7117:7128 ioctl c0306201 20000400 returned -14 12:47:15 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xf0ffffffffffff}}, 0x14}}, 0x0) [ 426.385393][ T7119] overlayfs: filesystem on './file0' not supported as upperdir 12:47:15 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x1000000000000000) 12:47:15 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:15 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x100000000000000}}, 0x14}}, 0x0) 12:47:15 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x30710000000000) 12:47:15 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x200000000000000}}, 0x14}}, 0x0) [ 426.624039][ T7240] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 427.081271][ T7355] binder_alloc: binder_alloc_mmap_handler: 7117 20001000-20004000 already mapped failed -16 [ 427.095459][ T7354] binder: BINDER_SET_CONTEXT_MGR already set [ 427.102240][ T7354] binder: 7117:7354 ioctl 40046207 0 returned -16 [ 427.102316][ T7355] binder_alloc: 7117: binder_alloc_buf, no vma [ 427.115098][ T7355] binder: 7117:7355 transaction failed 29189/-3, size 0-0 line 3147 [ 427.123279][ T7355] binder: 7117:7355 ioctl c0306201 20000400 returned -14 12:47:16 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x600000000000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:16 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x4000000000000000) 12:47:16 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:16 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x400000000000000}}, 0x14}}, 0x0) 12:47:16 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xa0393ffe7f0000) [ 427.130523][ T7669] binder: release 7117:7128 transaction 367 out, still active [ 427.137987][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 427.144428][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 427.150760][ T7669] binder: send failed reply for transaction 367, target dead 12:47:16 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) r2 = dup2(r0, r1) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140)='TIPC\x00') sendmsg$TIPC_CMD_SET_LINK_TOL(r2, &(0x7f0000000340)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000300)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYPTR=&(0x7f0000000480)=ANY=[@ANYPTR=&(0x7f0000000280)=ANY=[@ANYRES64=0x0, @ANYPTR, @ANYRESHEX=r0, @ANYRESHEX=r2, @ANYRESOCT=r2], @ANYRES32=r3, @ANYRES16=r3, @ANYPTR64=&(0x7f0000000400)=ANY=[@ANYRESDEC=r3, @ANYRESDEC=r3, @ANYRES32=r3, @ANYBLOB="1a243ed4ec440b6933c571968379d298798b6b8ea0f4fcfab0e40129", @ANYPTR64], @ANYRES32=r3, @ANYRES64=0x0, @ANYRES64=r0], @ANYBLOB="00082cbd7000fbdbdf25010000000000747da8c148c5beae000007410000004c00180000000673797a3000000000000000000000000000000023d98800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"], 0x3}, 0x1, 0x0, 0x0, 0x4000}, 0x1) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:47:16 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x800000000000000}}, 0x14}}, 0x0) [ 427.266072][ T7365] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 427.285557][ T7375] binder: 7362:7375 ioctl c0306201 20000400 returned -14 12:47:16 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x8000000000000000) 12:47:16 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:16 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xa00000000000000}}, 0x14}}, 0x0) 12:47:16 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xa0500000000000) [ 427.507219][ T7487] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:47:16 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xe00000000000000}}, 0x14}}, 0x0) [ 428.041340][ T7610] binder_alloc: binder_alloc_mmap_handler: 7362 20001000-20004000 already mapped failed -16 [ 428.051661][ T7609] binder: BINDER_SET_CONTEXT_MGR already set [ 428.057671][ T7609] binder: 7362:7609 ioctl 40046207 0 returned -16 [ 428.057688][ T7610] binder_alloc: 7362: binder_alloc_buf, no vma [ 428.070486][ T7610] binder: 7362:7610 transaction failed 29189/-3, size 0-0 line 3147 [ 428.078492][ T7610] binder: 7362:7610 ioctl c0306201 20000400 returned -14 12:47:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x700000000000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:17 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:17 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000000)='/dev/sequencer\x00', 0x0, 0x0) bind$bt_sco(r1, &(0x7f0000000040)={0x1f, {0x2, 0xc1fb, 0x4, 0x2e0, 0x2, 0x1}}, 0x8) bind$bt_l2cap(r1, &(0x7f00000000c0)={0x1f, 0x6, {0x3, 0xffff, 0x200, 0x1f, 0x8, 0x185}, 0xa0, 0x9}, 0xe) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r2, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:47:17 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xf00000000000000}}, 0x14}}, 0x0) 12:47:17 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xa0700000000000) [ 428.085824][ T7669] binder: release 7362:7375 transaction 370 out, still active [ 428.099904][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 428.105776][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 428.119778][ T7669] binder: send failed reply for transaction 370, target dead [ 428.198406][ T7628] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:47:17 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) pipe(&(0x7f0000000100)) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) 12:47:17 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x1000000000000000}}, 0x14}}, 0x0) 12:47:17 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='comm\x00') pwritev(r1, &(0x7f0000000000)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:47:17 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 428.311066][ T7699] binder: 7630:7699 ioctl c0306201 20000400 returned -14 [ 428.362431][ T7763] binder_alloc: binder_alloc_mmap_handler: 7630 20001000-20004000 already mapped failed -16 [ 428.396437][ T7786] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:47:17 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 428.413447][ T7763] binder_alloc: 7630: binder_alloc_buf, no vma [ 428.431866][ T7788] binder: BINDER_SET_CONTEXT_MGR already set [ 428.443251][ T7763] binder: 7630:7763 transaction failed 29189/-3, size 0-0 line 3147 12:47:17 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x6000000000000000}}, 0x14}}, 0x0) 12:47:17 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xee0f0000000000) [ 428.496240][ T7669] binder: release 7630:7699 transaction 373 out, still active [ 428.504567][ T7788] binder: 7630:7788 ioctl 40046207 0 returned -16 [ 428.506354][ T7763] binder: 7630:7763 ioctl c0306201 20000400 returned -14 [ 428.542784][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 428.575751][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 [ 428.590129][ T3486] binder: send failed reply for transaction 373, target dead 12:47:17 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x2000000000000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:17 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') ioctl$KVM_GET_IRQCHIP(r1, 0xc208ae62, &(0x7f0000000240)={0x0, 0x0, @ioapic}) pwritev(r2, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:47:17 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000b37000/0x1000)=nil, 0x1000}, 0x1}) read(r1, &(0x7f0000000100)=""/114, 0xfffffffffffffdaa) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 428.644911][ T7801] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:47:17 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x9effffff00000000}}, 0x14}}, 0x0) 12:47:17 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:17 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x800000000000000) [ 428.778513][ T7914] binder: 7910:7914 ioctl c0306201 20000400 returned -14 12:47:17 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) ioctl$KVM_TRANSLATE(r1, 0xc018ae85, &(0x7f0000000000)={0x2000, 0x6000, 0x2, 0x3ff, 0x6}) 12:47:17 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xc00e000000000000}}, 0x14}}, 0x0) [ 428.945610][ T7922] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:47:18 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xef02000000000000}}, 0x14}}, 0x0) 12:47:18 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) [ 428.989168][ T7980] overlayfs: filesystem on './file0' not supported as upperdir 12:47:18 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000000)='/dev/null\x00', 0x40000, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:47:18 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0xa00000000000000) [ 429.172294][ T8050] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 429.389814][ C0] net_ratelimit: 22 callbacks suppressed [ 429.389830][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 429.401287][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 429.567765][ T8164] binder_alloc: binder_alloc_mmap_handler: 7910 20001000-20004000 already mapped failed -16 [ 429.578115][ T8163] binder: BINDER_SET_CONTEXT_MGR already set [ 429.584906][ T8163] binder: 7910:8163 ioctl 40046207 0 returned -16 [ 429.584992][ T8164] binder_alloc: 7910: binder_alloc_buf, no vma [ 429.597965][ T8164] binder: 7910:8164 transaction failed 29189/-3, size 0-0 line 3147 [ 429.606039][ T8164] binder: 7910:8164 ioctl c0306201 20000400 returned -14 12:47:18 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x3f00000000000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:18 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xf0ffffff00000000}}, 0x14}}, 0x0) 12:47:18 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:18 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='\x05\x00\x00\x00r\xc0\xa4N\x98\xd1+\xe88za5\xaf~/\xdf\xc6\xb9\xb9\xafdo\xbd\xefl\xb2\x9c\xfd\x05aU)\xc9pv\xdf\x92\xde\x03\xf2\x1ez\xc0@1|\x95l\x16\x1c\xb4\xf8A^\xc8\xb6[o\x8f\xf9\xed\xc67\xc3\xb7o\x88\xd2\x00\x00\x00\x00\x00\x00\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) ioctl$KVM_SET_SREGS(r0, 0x4138ae84, &(0x7f0000000240)={{0xf000, 0x4002, 0x10, 0x2, 0x101, 0x1, 0x0, 0x1000, 0x9, 0xffffffff, 0x5, 0x4b3}, {0x2000, 0x2000, 0x10, 0x401, 0x3, 0x3, 0x0, 0x100000001, 0x1, 0x101, 0x5, 0x2}, {0x1000, 0x3000, 0xf, 0x5, 0x6, 0x1d68, 0x10001, 0x5, 0x3, 0x8b37, 0x8, 0x5}, {0x2000, 0x4, 0x4, 0x8, 0x1, 0xade6, 0xad, 0x8000, 0x2, 0xffffffffffffff01, 0xffff, 0x9c6}, {0x1, 0x10000, 0xf, 0x2, 0x80, 0x5, 0x101, 0x8, 0x1ff, 0x8, 0x3, 0x3f}, {0x107002, 0x1000, 0x0, 0x1, 0x3, 0x7, 0x100000001, 0x4, 0x7, 0x2, 0x1000000000, 0x5d4}, {0x103000, 0x3000, 0xc, 0x80000001, 0x9, 0x5, 0x8, 0x5, 0x4, 0x1552, 0x5, 0x6}, {0xf000, 0x7000, 0xd, 0xc61f, 0x1, 0x4, 0x6, 0x0, 0x4, 0x6a, 0xfffffffffffffffe}, {0x3000, 0x110000}, {0x2004, 0xf000}, 0x40000010, 0x0, 0x0, 0x0, 0xd, 0x1000, 0x2000, [0x3f, 0x7, 0xffffffffffffffff, 0x80]}) 12:47:18 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x1000000000000000) 12:47:18 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) r2 = dup(r0) setsockopt$CAIFSO_LINK_SELECT(r2, 0x116, 0x7f, &(0x7f0000000100)=0xffffffff80000001, 0x4) ioctl$UI_SET_SWBIT(r2, 0x4004556d, 0xa) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 429.613341][ T7669] binder: release 7910:7914 transaction 376 out, still active [ 429.627558][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 429.633606][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 429.640019][ T7669] binder: send failed reply for transaction 376, target dead [ 429.715577][ T8172] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 429.730785][ T8176] binder: 8166:8176 ioctl c0306201 20000400 returned -14 12:47:18 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:18 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xffffff7f00000000}}, 0x14}}, 0x0) 12:47:18 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x4, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, &(0x7f0000000040)=0x10001) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') ioctl$TCGETS(r1, 0x5401, &(0x7f00000000c0)) pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:47:18 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x4000000000000000) 12:47:18 executing program 2: r0 = userfaultfd(0x0) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040)='/dev/cuse\x00', 0x0, 0x0) read(r0, &(0x7f0000000180)=""/223, 0xdf) userfaultfd(0x800) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000068000/0x800000)=nil, 0x800000}, 0x1}) read(r1, &(0x7f0000465f8e)=""/114, 0x72) ioctl$UFFDIO_UNREGISTER(r0, 0x8010aa01, &(0x7f0000000080)={&(0x7f000001d000/0xc00000)=nil, 0xc00000}) [ 429.869773][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 429.875615][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 429.908605][ T8290] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:47:19 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0xfffffffffffff000}}, 0x14}}, 0x0) [ 430.429855][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 430.435703][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 430.505994][ T8414] binder_alloc: binder_alloc_mmap_handler: 8166 20001000-20004000 already mapped failed -16 [ 430.516393][ T8414] binder_alloc: 8166: binder_alloc_buf, no vma [ 430.522432][ T8413] binder: BINDER_SET_CONTEXT_MGR already set [ 430.522648][ T8414] binder: 8166:8414 transaction failed 29189/-3, size 0-0 line 3147 [ 430.528758][ T8413] binder: 8166:8413 ioctl 40046207 0 returned -16 [ 430.536753][ T8414] binder: 8166:8414 ioctl c0306201 20000400 returned -14 12:47:19 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x4800000000000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:19 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:19 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$vcsa(&(0x7f0000000000)='/dev/vcsa#\x00', 0x10000, 0x40000) setsockopt$inet_tcp_int(r1, 0x6, 0x6, &(0x7f0000000040)=0x2, 0x4) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r2, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:47:19 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x8000000000000000) 12:47:19 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x0, 0x2}}, 0x14}}, 0x0) 12:47:19 executing program 2: perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0x0, 0xffffffffffffffff, 0x0) r0 = eventfd2(0x0, 0x0) ptrace$getregs(0xe, 0x0, 0x6, &(0x7f00000001c0)=""/249) r1 = open(&(0x7f00000000c0)='./file0\x00', 0x20141042, 0x0) socket$nl_route(0x10, 0x3, 0x0) ftruncate(r1, 0xb3d4) sendfile(r0, r1, &(0x7f0000000040), 0x2008004fffffffe) [ 430.550360][ T7669] binder: release 8166:8176 transaction 379 out, still active [ 430.557859][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 430.569828][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 430.576061][ T7669] binder: send failed reply for transaction 379, target dead [ 430.669803][ C1] protocol 88fb is buggy, dev hsr_slave_0 [ 430.669819][ C0] protocol 88fb is buggy, dev hsr_slave_0 [ 430.675641][ C1] protocol 88fb is buggy, dev hsr_slave_1 [ 430.681648][ C0] protocol 88fb is buggy, dev hsr_slave_1 [ 430.691635][ T8436] binder: 8426:8436 ioctl c0306201 20000400 returned -14 12:47:19 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x0, 0x4}}, 0x14}}, 0x0) [ 430.748525][ T8423] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 430.773529][ T8477] binder_alloc: binder_alloc_mmap_handler: 8426 20001000-20004000 already mapped failed -16 [ 430.798148][ T8477] binder: BINDER_SET_CONTEXT_MGR already set 12:47:19 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) r1 = syz_open_dev$adsp(&(0x7f0000000000)='/dev/adsp#\x00', 0x1, 0x44000) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffff9c, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e20, 0x56ac, @empty, 0x5}}, 0x100000000, 0x1, 0x3f, 0x5, 0x4}, &(0x7f0000000040)=0x98) getsockopt$inet_sctp_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f00000001c0)={0x2a, 0xc020, 0x8000, 0x3, 0x6, 0xff, 0xffffffff, 0x2, r2}, &(0x7f0000000240)=0x20) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r3, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) [ 430.826472][ T8515] binder_alloc: 8426: binder_alloc_buf, no vma 12:47:19 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:19 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0)='/dev/kvm\x00', 0xfffffffffffffffb, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:47:19 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x0, 0x8}}, 0x14}}, 0x0) [ 430.875501][ T3486] binder: release 8426:8436 transaction 382 out, still active [ 430.884073][ T8477] binder: 8426:8477 ioctl 40046207 0 returned -16 [ 430.897466][ T3486] binder: undelivered TRANSACTION_COMPLETE 12:47:19 executing program 2: socket(0x0, 0x0, 0x0) r0 = creat(&(0x7f0000000140)='./file0\x00', 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000000040), &(0x7f00000000c0)=0x1b8) ioctl$TUNSETPERSIST(0xffffffffffffffff, 0x400454cb, 0x0) fsetxattr$system_posix_acl(0xffffffffffffffff, &(0x7f0000000280)='system.posix_acl_default\x00', 0x0, 0x0, 0x2) perf_event_open(&(0x7f000001d000)={0x1, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_bp={0x0}}, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0) r1 = openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000100)='/dev/loop-control\x00', 0x40, 0x0) ioctl$LOOP_CTL_REMOVE(r1, 0x4c81, 0x0) ioctl$LOOP_CTL_ADD(r1, 0x4c80, 0x0) ioctl$EXT4_IOC_SWAP_BOOT(0xffffffffffffffff, 0x6611) [ 430.926092][ T8515] binder: 8426:8515 transaction failed 29189/-3, size 0-0 line 3147 [ 430.960214][ T8515] binder: 8426:8515 ioctl c0306201 20000400 returned -14 [ 430.968190][ T3486] binder: send failed reply for transaction 382, target dead 12:47:20 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x4c00000000000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) [ 431.002859][ T3486] binder: undelivered TRANSACTION_ERROR: 29189 12:47:20 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x0, 0xa}}, 0x14}}, 0x0) 12:47:20 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) r2 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000000)='/dev/rfkill\x00', 0x80000, 0x0) getsockopt$inet6_dccp_int(r2, 0x21, 0x7, &(0x7f0000000040), &(0x7f00000000c0)=0x4) signalfd4(r1, &(0x7f0000000100)={0x1000}, 0x8, 0x0) [ 431.135770][ T8591] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 431.172052][ T8663] binder: 8614:8663 ioctl c0306201 20000400 returned -14 12:47:20 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:47:20 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x0, 0xe}}, 0x14}}, 0x0) 12:47:20 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:20 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x0, 0xf}}, 0x14}}, 0x0) 12:47:20 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') ioctl$TUNSETVNETHDRSZ(r1, 0x400454d8, &(0x7f0000000000)=0x5f26) ioctl$KVM_X86_SETUP_MCE(r1, 0x4008ae9c, &(0x7f0000000040)={0xc, 0x1, 0x1e}) pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:47:20 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x0, 0x10}}, 0x14}}, 0x0) 12:47:20 executing program 2: r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl(r0, 0x81000008912, &(0x7f0000000100)="0adc1f123c40a41d88b070") socket$xdp(0x2c, 0x3, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000680)='/dev/loop#\x00', 0x0, 0x800000000105082) sendfile(r1, r1, &(0x7f00000ddff8), 0x102000000) [ 431.503344][ T8793] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only 12:47:20 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) setsockopt$RXRPC_SECURITY_KEY(r1, 0x110, 0x1, &(0x7f0000000000)='clear_refs\x00', 0xb) r2 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') ioctl$TIOCGWINSZ(r2, 0x5413, &(0x7f0000000040)) ioctl$SNDRV_CTL_IOCTL_ELEM_REMOVE(r2, 0xc0405519, &(0x7f00000000c0)={0x7, 0x6, 0x3, 0x0, 'syz0\x00', 0x1}) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r2, 0x84, 0x13, &(0x7f0000000100)=0x1, 0x4) pwritev(r2, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:47:20 executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180)='/dev/kvm\x00', 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f00000000c0)={0x0, 0x119000}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd9c) bind$netlink(0xffffffffffffffff, &(0x7f0000000000)={0x10, 0x0, 0x25dfdbfb}, 0x6) ioctl$KVM_NMI(r2, 0xae9a) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_genetlink_get_family_id$net_dm(0x0) [ 431.778098][ T8826] *** Guest State *** [ 431.790450][ T8826] CR0: actual=0x0000000000000031, shadow=0x0000000060000011, gh_mask=fffffffffffffff7 [ 431.806120][ T8826] CR4: actual=0x0000000000002060, shadow=0x0000000000000020, gh_mask=ffffffffffffe871 [ 431.823095][ T8826] CR3 = 0x0000000000002000 [ 431.829042][ T8826] PDPTR0 = 0x000000003180c001 PDPTR1 = 0x00000000316b1001 [ 431.847606][ T8826] PDPTR2 = 0x00000000316b2001 PDPTR3 = 0x0000000001a3d001 [ 431.855953][ T8826] RSP = 0x0000000000000f80 RIP = 0x0000000000000005 [ 431.862953][ T8826] RFLAGS=0x00000202 DR7 = 0x0000000000000400 [ 431.869657][ T8826] Sysenter RSP=0000000000000f80 CS:RIP=0050:0000000000002810 [ 431.877329][ T8826] CS: sel=0x0030, attr=0x0409b, limit=0x000fffff, base=0x0000000000000000 [ 431.886727][ T8826] DS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 431.895492][ T8826] SS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 431.904400][ T8826] ES: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 431.913349][ T8826] FS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 431.922393][ T8826] GS: sel=0x0038, attr=0x04093, limit=0x000fffff, base=0x0000000000000000 [ 431.931161][ T8826] GDTR: limit=0x000007ff, base=0x0000000000001000 [ 431.940201][ T8826] LDTR: sel=0x0008, attr=0x04082, limit=0x000007ff, base=0x0000000000001800 [ 431.948920][ T8826] IDTR: limit=0x000001ff, base=0x0000000000003800 [ 431.958094][ T8921] binder_alloc: binder_alloc_mmap_handler: 8614 20001000-20004000 already mapped failed -16 [ 431.969464][ T8826] TR: sel=0x0000, attr=0x0008b, limit=0x0000ffff, base=0x0000000000000000 [ 431.970011][ T8921] binder_alloc: 8614: binder_alloc_buf, no vma [ 431.978205][ T8826] EFER = 0x0000000000000001 PAT = 0x0007040600070406 [ 431.984918][ T8920] binder: BINDER_SET_CONTEXT_MGR already set [ 431.998135][ T8920] binder: 8614:8920 ioctl 40046207 0 returned -16 [ 431.999053][ T8826] DebugCtl = 0x0000000000000000 DebugExceptions = 0x0000000000000000 [ 432.004736][ T8921] binder: 8614:8921 transaction failed 29189/-3, size 0-0 line 3147 [ 432.019277][ T8826] Interruptibility = 00000001 ActivityState = 00000000 12:47:21 executing program 1: r0 = syz_open_dev$binder(&(0x7f00000000c0)='/dev/binder#\x00', 0xffffffffffffffff, 0x0) r1 = syz_open_dev$binder(0x0, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x0, 0x20011, r1, 0x0) ioctl$BINDER_SET_CONTEXT_MGR(r1, 0x40046207, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000400)={0x1f, 0x0, &(0x7f0000000500)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0xffffffffffffffbd, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000040)={0x4, 0x6000000000000000, &(0x7f0000000000)=[@register_looper], 0x1, 0x0, &(0x7f0000000140)="06"}) 12:47:21 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x0, 0x60}}, 0x14}}, 0x0) 12:47:21 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:21 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r1, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x3, &(0x7f0000000000)=0x7fff, 0x4) prctl$PR_GET_FP_MODE(0x2e) 12:47:21 executing program 4: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') r2 = shmget$private(0x0, 0x2000, 0x4, &(0x7f0000ffb000/0x2000)=nil) shmctl$IPC_INFO(r2, 0x3, &(0x7f00000000c0)=""/167) pwritev(r1, &(0x7f0000000180), 0x0, 0x400000000000000) [ 432.021214][ T7669] binder: release 8614:8663 transaction 385 out, still active [ 432.028071][ T8826] *** Host State *** [ 432.036153][ T8921] binder: 8614:8921 ioctl c0306201 20000400 returned -14 [ 432.046608][ T8826] RIP = 0xffffffff811b3d70 RSP = 0xffff88802eb5f8e0 [ 432.053402][ T7669] binder: undelivered TRANSACTION_COMPLETE [ 432.059290][ T7669] binder: undelivered TRANSACTION_ERROR: 29189 [ 432.065570][ T8826] CS=0010 SS=0018 DS=0000 ES=0000 FS=0000 GS=0000 TR=0040 [ 432.073043][ T7669] binder: send failed reply for transaction 385, target dead 12:47:21 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x0, 0xf0}}, 0x14}}, 0x0) [ 432.154303][ T8826] FSBase=00007f8aa7f1f700 GSBase=ffff8880ae900000 TRBase=fffffe0000003000 [ 432.165131][ T8930] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 432.203407][ T8954] binder: 8953:8954 ioctl c0306201 20000400 returned -14 12:47:21 executing program 5: mkdir(&(0x7f0000000000)='./file1\x00', 0x0) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) capset(&(0x7f0000000280)={0x19980330}, &(0x7f0000001fe8)={0x20000fffffff8, 0xffffffffffffffff}) mount$overlay(0x400000, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='overlay\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='upperdir=./file0,lowerdir=.:file0,workdir=./file1']) 12:47:21 executing program 3: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) vmsplice(r0, &(0x7f0000000580)=[{&(0x7f0000000000)="49b80c48bb37cddd0220b5a9514f04d1930715fd5e66951f81ae49b95eb1d52e94b61474bf8b8c05e152e6dedf84be0e12aafc014a36c66bfb19a617fc2f519a31b3ec285caec6c9a473a6be4834c8653b1c046428719d19a270", 0x5a}, {&(0x7f00000000c0)="3c88aabc014d1969cc6753b4d22dff01cb8025a303bb577e52349a99e9b0869f8485d82a1f4f2286754facc9bda5a7198a4d9d3fbb42a0d30f7c2787e17fd17c9a4449b557cfc5871a14ed73c5a0d3cfc7ec39d4a3e0491574af984eaef13a038650a290b84abbac67f136e4a78e79a4aff87bd8983712ac71617a5a502dad9de6d41767377a2f6b33d2c2f01336fbcd17b9b25d35e963aae4ac02522c321635b995a1551039a461ab4d0269eceadd830da2a04579cd58f49b97", 0xba}, {&(0x7f0000000240)="5fc941d1b2b7e9b5dfd10634f46f2d925d39e00008c75b9fb232ad3c9acc079330b41d25ce13e8c7e01e0b141372fdafc070eea0467cd77f0b00718c64e4b44010843a4c35ed44c384981260ecbc3ff93edb931b970ce487cd6e1070b277cbd44a367c2f18d8b4c5ff994d41075b8b5dc2e273d9be898b95ed7b034d9eb6a42a5c0bfd4f764aa254", 0x88}, {&(0x7f00000001c0)="4f03b0e57e31b79ae29aaf0561b37991857228b48db869061517c71cfdcc823db3fb7aa1506cd5f7aa8cb4cd21f179dc16163a953a2d", 0x36}, {&(0x7f0000000300)="75a0bce7034d413084f02e8ab68853c26f0fd5ad0f755fc2e350276d08d65b97077fb49f09eab499f0944ec9611098b691316a79fb06a0b08cd9362d8861e553fdbf2613cd39efefca0b120a413f85ba4dc874bffd63e74102e13ff691779f4a863f", 0x62}, {&(0x7f0000000380)="0959806dadf73a8a5c36a9174e236055d97275cc1b86f1e2de373efb9034e3c7c6383e6a660569ea61d33e1ec9f559c1e3fea8806e6a89b39c8d68492bc2f8fb8dfa9c7593c9b2b22aba3a3d2a83b0c64ad014ad03743274be11", 0x5a}, {&(0x7f0000000400)="3c78be4929c91642294be8a540c5b4b167a7b82c83d468a5218d86ebf3228c57b1537a1c46f9d926fae28dba34863abacad7554ad5724e956351d70c5a7c83b6d41d4377ee2bc2dff83be246b6e200b45bff88d65dbd580bd2ad5c3323980c2466a472979073af5615c840d79e48d0dc2294e81f5f64323e423f036497e85922eab434a86d92e67081c5a72c10decfd5575d257aaa5169255c40b7de265ad2b400efee6996b903f3f576f25f8f59fde374e1a605ee0683bfda2951c016cb4b6c5e5c04b785bf78350870cf65ecdade400a023cbb61cf68beee64322b3285f5077ed52ac717f317ad00c8c3939c9530", 0xef}], 0x7, 0x4) r1 = openat$audio(0xffffffffffffff9c, &(0x7f0000000980)='/dev/audio\x00', 0x200800, 0x0) r2 = syz_open_dev$dspn(&(0x7f00000009c0)='/dev/dsp#\x00', 0x89, 0x80) ioctl$VHOST_SET_VRING_CALL(r1, 0x4008af21, &(0x7f0000000a00)={0x0, r2}) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') r5 = shmget(0x2, 0x3000, 0x54000020, &(0x7f0000ffa000/0x3000)=nil) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000500)={0x0, 0x0}, &(0x7f0000000600)=0xc) fstat(r3, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f00000006c0)={{{@in=@multicast2, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@multicast1}, 0x0, @in6=@local}}, &(0x7f00000007c0)=0xe8) lstat(&(0x7f0000000800)='./file0\x00', &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r10 = fcntl$getown(r3, 0x9) fcntl$getownex(r3, 0x10, &(0x7f00000008c0)={0x0, 0x0}) shmctl$IPC_SET(r5, 0x1, &(0x7f0000000900)={{0x571f, r6, r7, r8, r9, 0x80, 0xffff}, 0x0, 0x0, 0x3, 0x5, r10, r11, 0x200}) pwritev(r4, &(0x7f0000000180)=[{&(0x7f0000000080)='4', 0x1}], 0x1, 0x0) 12:47:21 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x0, 0x2ef}}, 0x14}}, 0x0) [ 432.250030][ T8826] GDTBase=fffffe0000031000 IDTBase=fffffe0000000000 [ 432.282510][ T8826] CR0=0000000080050033 CR3=0000000090d54000 CR4=00000000001426e0 [ 432.310770][ T8826] Sysenter RSP=fffffe0000002200 CS:RIP=0010:ffffffff87201360 [ 432.335125][ T8826] EFER = 0x0000000000000d01 PAT = 0x0407050600070106 12:47:21 executing program 4: r0 = syz_open_dev$midi(&(0x7f0000000040)='/dev/midi#\x00', 0x96, 0x400) ioctl$KVM_KVMCLOCK_CTRL(r0, 0xaead) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200)='/dev/kvm\x00', 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000540)='clear_refs\x00') pwritev(r2, &(0x7f0000000180)=[{&(0x7f0000000000)='4', 0x1}], 0x1, 0x0) [ 432.381086][ T8826] *** Control State *** [ 432.390756][ T8826] PinBased=0000003f CPUBased=b5986dfa SecondaryExec=000000ca [ 432.392678][ T9051] overlayfs: failed to create directory ./file1/work (errno: 13); mounting read-only [ 432.411757][ T8826] EntryControls=0000d1ff ExitControls=002fefff 12:47:21 executing program 0: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = socket$l2tp(0x18, 0x1, 0x1) connect$l2tp(r1, &(0x7f0000000180)=@pppol2tpv3={0x18, 0x1, {0x0, r0, {0x2, 0x0, @multicast2}, 0x4}}, 0x26) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)={0x14, 0x29, 0xffffff1f, 0x0, 0x0, {0x8, 0x0, 0xa00}}, 0x14}}, 0x0) [ 432.435989][ T8826] ExceptionBitmap=00060042 PFECmask=00000000 PFECmatch=00000000 [ 432.450016][ T9059] kasan: CONFIG_KASAN_INLINE enabled [ 432.459454][ T9059] kasan: GPF could be caused by NULL-ptr deref or user memory access [ 432.469587][ T9059] general protection fault: 0000 [#1] PREEMPT SMP KASAN [ 432.473804][ T9048] kobject: 'kvm' (00000000ee8a4ac5): kobject_uevent_env [ 432.476530][ T9059] CPU: 0 PID: 9059 Comm: syz-executor.4 Not tainted 5.0.0-rc8-next-20190301 #1 [ 432.476540][ T9059] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 432.476562][ T9059] RIP: 0010:__dentry_path+0x49e/0x7c0 [ 432.476585][ T9059] Code: 89 fc 41 83 e4 01 44 89 e6 e8 3e c8 b1 ff 45 84 e4 0f 85 04 02 00 00 e8 f0 c6 b1 ff 48 8b 85 18 ff ff ff 44 89 bd 40 ff ff ff <80> 38 00 0f 85 f9 02 00 00 48 8b 85 38 ff ff ff 41 83 e7 01 44 89 [ 432.485826][ T8826] VMEntry: intr_info=80000202 errcode=00000000 ilen=00000000 [ 432.492402][ T9059] RSP: 0018:ffff88802f177ad8 EFLAGS: 00010216 [ 432.492413][ T9059] RAX: dffffc0000000005 RBX: 0000000000000000 RCX: ffffc9000e66f000 [ 432.492421][ T9059] RDX: 0000000000003b9a RSI: ffffffff81befb10 RDI: 0000000000000001 [ 432.492429][ T9059] RBP: ffff88802f177bc8 R08: ffff8880999dc0c0 R09: 0000000000000000 [ 432.492437][ T9059] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 432.492445][ T9059] R13: ffff88802f177ba0 R14: ffff88804f5752fe R15: 00000000000045b2 [ 432.492455][ T9059] FS: 00007fe6f4193700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 432.492463][ T9059] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 432.492471][ T9059] CR2: 00007f7b0a116000 CR3: 0000000098212000 CR4: 00000000001426f0 [ 432.492481][ T9059] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 432.492489][ T9059] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 432.492499][ T9059] Call Trace: [ 432.512246][ T9048] kobject: 'kvm' (00000000ee8a4ac5): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 432.527503][ T9059] ? simple_dname+0x1f0/0x1f0 [ 432.527524][ T9059] ? kmem_cache_alloc_trace+0x354/0x760 [ 432.527541][ T9059] dentry_path_raw+0x26/0x30 [ 432.527622][ T9059] kvm_uevent_notify_change.part.0+0x213/0x440 [ 432.527642][ T9059] kvm_dev_ioctl+0x105b/0x15e0 [ 432.543245][ T8918] kobject: 'kvm' (00000000ee8a4ac5): kobject_uevent_env [ 432.549057][ T9059] ? kvm_debugfs_release+0x90/0x90 [ 432.549086][ T9059] ? __fget+0x35a/0x550 [ 432.549104][ T9059] ? kvm_debugfs_release+0x90/0x90 [ 432.549123][ T9059] do_vfs_ioctl+0xd6e/0x1390 [ 432.572147][ T8918] kobject: 'kvm' (00000000ee8a4ac5): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 432.573002][ T9059] ? ioctl_preallocate+0x210/0x210 [ 432.595294][ T8826] VMExit: intr_info=00000000 errcode=00000000 ilen=00000003 [ 432.596442][ T9059] ? __fget+0x381/0x550 [ 432.596460][ T9059] ? ksys_dup3+0x3e0/0x3e0 [ 432.596503][ T9059] ? nsecs_to_jiffies+0x30/0x30 [ 432.596544][ T9059] ? tomoyo_file_ioctl+0x23/0x30 [ 432.619007][ T9048] kobject: 'kvm' (00000000ee8a4ac5): kobject_uevent_env [ 432.620386][ T9059] ? __sanitizer_cov_trace_const_cmp4+0x16/0x20 [ 432.620403][ T9059] ? security_file_ioctl+0x93/0xc0 [ 432.620419][ T9059] ksys_ioctl+0xab/0xd0 [ 432.620435][ T9059] __x64_sys_ioctl+0x73/0xb0 [ 432.620451][ T9059] do_syscall_64+0x103/0x610 [ 432.620474][ T9059] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 432.628955][ T8826] reason=80000021 qualification=0000000000000003 [ 432.633430][ T9059] RIP: 0033:0x457e29 [ 432.633444][ T9059] Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 [ 432.633451][ T9059] RSP: 002b:00007fe6f4192c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 432.633463][ T9059] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457e29 [ 432.633471][ T9059] RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000003 [ 432.633478][ T9059] RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 [ 432.633485][ T9059] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fe6f41936d4 [ 432.633493][ T9059] R13: 00000000004c093a R14: 00000000004d2750 R15: 00000000ffffffff [ 432.633507][ T9059] Modules linked in: [ 432.665274][ T9059] ---[ end trace 27fa76385a02ae87 ]--- [ 432.678873][ T9048] kobject: 'kvm' (00000000ee8a4ac5): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 432.686789][ T9059] RIP: 0010:__dentry_path+0x49e/0x7c0 [ 432.780699][ T8826] IDTVectoring: info=00000000 errcode=00000000 [ 432.795359][ T3876] kobject: 'loop3' (000000003fc2d549): kobject_uevent_env [ 432.856526][ T8810] kobject: 'kvm' (00000000ee8a4ac5): kobject_uevent_env [ 432.867875][ T8826] TSC Offset = 0xffffff16512fc44c [ 432.874112][ T9059] Code: 89 fc 41 83 e4 01 44 89 e6 e8 3e c8 b1 ff 45 84 e4 0f 85 04 02 00 00 e8 f0 c6 b1 ff 48 8b 85 18 ff ff ff 44 89 bd 40 ff ff ff <80> 38 00 0f 85 f9 02 00 00 48 8b 85 38 ff ff ff 41 83 e7 01 44 89 [ 432.884822][ T8826] EPT pointer = 0x0000000088bb201e [ 432.919792][ T8810] kobject: 'kvm' (00000000ee8a4ac5): fill_kobj_path: path = '/devices/virtual/misc/kvm' [ 432.921985][ T3876] kobject: 'loop3' (000000003fc2d549): fill_kobj_path: path = '/devices/virtual/block/loop3' [ 432.929552][ T9059] RSP: 0018:ffff88802f177ad8 EFLAGS: 00010216 [ 432.966429][ T9059] RAX: dffffc0000000005 RBX: 0000000000000000 RCX: ffffc9000e66f000 [ 432.974553][ T9059] RDX: 0000000000003b9a RSI: ffffffff81befb10 RDI: 0000000000000001 [ 432.982762][ T9059] RBP: ffff88802f177bc8 R08: ffff8880999dc0c0 R09: 0000000000000000 [ 432.993288][ T9182] binder_alloc: binder_alloc_mmap_handler: 8953 20001000-20004000 already mapped failed -16 [ 432.999751][ T9059] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 433.003638][ T9182] binder_alloc: 8953: binder_alloc_buf, no vma [ 433.011668][ T9059] R13: ffff88802f177ba0 R14: ffff88804f5752fe R15: 00000000000045b2 [ 433.021450][ T9181] binder: BINDER_SET_CONTEXT_MGR already set [ 433.025820][ T9059] FS: 00007fe6f4193700(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 [ 433.033290][ T9182] binder: 8953:9182 transaction failed 29189/-3, size 0-0 line 3147 [ 433.040766][ T9059] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 433.052324][ T7660] binder: release 8953:8954 transaction 388 out, still active [ 433.055654][ T9059] CR2: 0000000000000000 CR3: 0000000098212000 CR4: 00000000001426f0 [ 433.062880][ T9181] binder: 8953:9181 ioctl 40046207 0 returned -16 [ 433.070998][ T9059] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 433.080459][ T7660] binder: undelivered TRANSACTION_COMPLETE [ 433.085339][ T9059] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 433.093464][ T9182] binder: 8953:9182 ioctl c0306201 20000400 returned -14 [ 433.099338][ T9059] Kernel panic - not syncing: Fatal exception [ 433.107515][ T7660] binder: send failed reply for transaction 388, target dead [ 433.113132][ T9059] Kernel Offset: disabled [ 433.124781][ T9059] Rebooting in 86400 seconds..